CVE-2026-55529: PraisonAI Authentication Bypass Vulnerability

CVE-2026-55529 Overview

CVE-2026-55529 is a missing authentication and origin validation flaw in PraisonAI, a multi-agent teams system. The _validate_origin method in the MCP HTTP Stream implementation uses request_origin.startswith(allowed), which allows attacker-controlled origins such as localhost.evil.example to satisfy the localhost allowlist. When no API key is configured, a malicious webpage can issue tools/call requests to the local MCP server and invoke exposed tools. The issue is tracked under [CWE-306: Missing Authentication for Critical Function] and is fixed in PraisonAI 4.6.58.

Critical Impact
A malicious webpage visited by a user running a local PraisonAI MCP server can execute arbitrary exposed tools without authentication, leading to potential command execution and data exposure.

Affected Products

PraisonAI versions prior to 4.6.58
PraisonAI MCP HTTP Stream server component
Deployments where the MCP server runs without an auth_token

Discovery Timeline

2026-08-25 - CVE-2026-55529 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-55529

Vulnerability Analysis

The PraisonAI MCP HTTP Stream server exposes tool invocation endpoints intended to be reachable only from localhost. To enforce this boundary, _validate_origin compares an incoming Origin header against an allowlist using Python's str.startswith. This comparison is a prefix match, not a hostname match. An origin like http://localhost.evil.example therefore starts with the allowed prefix http://localhost and is accepted as trusted.

When the server is started without an auth_token, no additional authentication check gates tool execution. A user browsing an attacker-controlled site can trigger cross-origin tools/call requests that pass origin validation. The MCP server then executes the referenced tool with the privileges of the local process. Impact depends on which tools are exposed, but ranges from information disclosure to arbitrary command execution on the host.

Root Cause

Two defects combine to produce the vulnerability. First, _validate_origin performs a substring-prefix comparison rather than parsing the origin URL and comparing the host component. Second, the server treats a successful origin check as sufficient authorization when no bearer token is configured, violating the principle of authenticated tool invocation.

Attack Vector

Exploitation requires the victim to run a vulnerable PraisonAI MCP server locally and visit a webpage controlled by the attacker. The attacker's page issues HTTP requests to the local MCP endpoint using an origin whose hostname begins with localhost. Because no API key is required, the server dispatches the request and executes the specified tool.

python

# Patch: bearer token enforcement added in PraisonAI 4.6.58
# src/praisonai-agents/praisonaiagents/server/server.py

def _authorise_request(self, request) -> bool:
    """Verify bearer token when auth_token is configured."""
    token = self.config.auth_token
    if not token:
        return True
    auth = request.headers.get("Authorization", "")
    if auth.startswith("Bearer ") and auth[7:] == token:
        return True
    return request.headers.get("X-Auth-Token") == token

Source: PraisonAI commit 2f9677a

Detection Methods for CVE-2026-55529

Indicators of Compromise

HTTP requests to the local MCP endpoint carrying Origin headers that contain localhost as a substring but not as a standalone host (for example localhost.evil.example, localhost-attacker.com).
Unexpected tools/call invocations in PraisonAI MCP server logs, particularly from browser user agents.
Child processes spawned by the PraisonAI runtime that correlate with external web activity.

Detection Strategies

Parse the Origin header host component during log review and alert when the effective hostname is not exactly localhost, 127.0.0.1, or ::1.
Correlate browser navigation events with local MCP request bursts to identify drive-by tool invocation attempts.
Monitor for outbound network activity or file system writes initiated by MCP tool executions.

Monitoring Recommendations

Enable verbose request logging on the PraisonAI MCP server, capturing Origin, Referer, and Authorization headers.
Forward MCP and host process telemetry to a centralized analytics pipeline for correlation with web proxy logs.
Baseline expected tool invocation patterns and alert on deviations, particularly invocations without an Authorization header.

How to Mitigate CVE-2026-55529

Immediate Actions Required

Upgrade PraisonAI to version 4.6.58 or later, which fixes both the origin comparison logic and mandatory authentication path.
Configure an auth_token on all MCP server deployments so tool invocation requires a bearer token even on localhost.
Restrict the MCP server's bind address to 127.0.0.1 and block cross-origin browser access at the network layer where feasible.

Patch Information

The fix is included in PraisonAI v4.6.58. The commit 2f9677a hardens input validation and adds an _authorise_request method that requires a bearer token when auth_token is set. Full advisory details are available in GHSA-wj6g-v78p-6fx3.

Workarounds

Set an auth_token in the MCP server configuration and require clients to send Authorization: Bearer <token> on every request.
Terminate the MCP server when not in active use to reduce exposure to drive-by browser attacks.
Deploy a local reverse proxy that validates the Origin header host component exactly against an allowlist before forwarding requests to the MCP server.

bash

# Example: enforce authentication by exporting an auth token before start
export PRAISONAI_MCP_AUTH_TOKEN="$(openssl rand -hex 32)"
praisonai mcp serve --host 127.0.0.1 --port 8080