CVE-2026-55532: PraisonAI Authentication Bypass Vulnerability

CVE-2026-55532 Overview

CVE-2026-55532 is an origin validation flaw in PraisonAI, a multi-agent teams system. Versions prior to 4.6.58 implement the MCP HTTP Stream _validate_origin check using request_origin.startswith(allowed). An attacker-controlled host such as localhost.attacker.com satisfies the localhost allowlist because of the prefix comparison. A malicious webpage can issue Content-Type: text/plain requests without triggering a CORS preflight and invoke tools/call without an API key. This includes file-write tools that persist agent instructions, giving the attacker control over subsequent agent behavior. The issue is fixed in PraisonAI 4.6.58 and tracked under [CWE-346: Origin Validation Error].

Critical Impact
Cross-origin webpages can invoke privileged MCP tools on a victim's local PraisonAI instance without authentication, enabling persistent agent hijacking through file writes.

Affected Products

PraisonAI versions prior to 4.6.58
PraisonAI MCP HTTP Stream transport (_validate_origin code path)
Deployments exposing the PraisonAI server on localhost accessible from a browser

Discovery Timeline

2026-08-25 - CVE-2026-55532 published to the National Vulnerability Database
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-55532

Vulnerability Analysis

The PraisonAI MCP HTTP Stream transport enforces an origin allowlist to restrict which browser contexts can reach agent tooling. The check uses Python's str.startswith against entries such as http://localhost or http://127.0.0.1. Any hostname that begins with those tokens, including attacker-controlled DNS names like http://localhost.attacker.com, passes validation. Combined with the choice of Content-Type: text/plain, the request qualifies as a CORS simple request and skips the browser preflight. The server also accepts tools/call invocations on this path without requiring an API key, so a drive-by page can execute file-write tools and rewrite persisted agent instructions.

Root Cause

The defect is a string-prefix comparison used for origin authorization. Prefix matching does not enforce a hostname boundary, so localhost.attacker.com is treated as equivalent to localhost. The transport layer also fails to require an authentication token for tool invocations, so a single bypass produces full tool access.

Attack Vector

Exploitation requires user interaction: a victim running PraisonAI locally must visit an attacker-controlled webpage. That page issues a cross-origin POST with Content-Type: text/plain and a JSON body invoking tools/call. Because the attacker's origin satisfies the flawed prefix check, the server processes the request. The attacker can then call file-write tools to overwrite agent memory or instructions, achieving persistence across future agent sessions.

python

# Patch excerpt: src/praisonai-agents/praisonaiagents/server/server.py
# Adds bearer-token authorization for MCP requests.

def _authorise_request(self, request) -> bool:
    """Verify bearer token when auth_token is configured."""
    token = self.config.auth_token
    if not token:
        return True
    auth = request.headers.get("Authorization", "")
    if auth.startswith("Bearer ") and auth[7:] == token:
        return True
    return request.headers.get("X-Auth-Token") == token

Source: PraisonAI commit 2f9677a

python

# Patch excerpt: src/praisonai-agents/praisonaiagents/memory/file_memory.py
# Rejects path traversal in user_id before it becomes a directory name.

@staticmethod
def _sanitise_user_id(user_id: str) -> str:
    """Reject path traversal in user_id before using it as a directory name."""
    if not user_id or not isinstance(user_id, str):
        return "default"
    if ".." in user_id or "/" in user_id or "\\" in user_id:
        raise ValueError("user_id must not contain path separators or parent references")
    safe = user_id.strip()
    return safe or "default"

Source: PraisonAI commit 2f9677a

Detection Methods for CVE-2026-55532

Indicators of Compromise

HTTP requests to the PraisonAI MCP endpoint with an Origin header whose hostname contains localhost or 127.0.0.1 as a prefix but includes additional characters, such as localhost.attacker.com.
POST requests to tools/call carrying Content-Type: text/plain instead of application/json.
Unexpected modifications to agent memory files or persisted instruction stores written by the PraisonAI file-memory subsystem.

Detection Strategies

Inspect PraisonAI server access logs for Origin values that do not exactly equal a trusted host and flag prefix-only matches.
Alert on MCP tools/call invocations that omit an Authorization or X-Auth-Token header when auth_token is expected to be configured.
Baseline the write frequency and content of agent memory files, and alert on writes originating from HTTP requests rather than agent execution.

Monitoring Recommendations

Forward PraisonAI application logs and reverse-proxy access logs to a central analytics platform for correlation of origin, content-type, and tool-invocation fields.
Monitor outbound DNS from developer workstations for lookalike localhost.* domains that could be used to bypass origin allowlists.
Track the PraisonAI version deployed across hosts and alert when instances remain on versions earlier than 4.6.58.

How to Mitigate CVE-2026-55532

Immediate Actions Required

Upgrade PraisonAI to version 4.6.58 or later on all hosts running the MCP HTTP Stream transport.
Configure auth_token so the patched _authorise_request path enforces a bearer token on every MCP request.
Audit persisted agent memory and instruction files for unauthorized writes and restore known-good copies if tampering is suspected.

Patch Information

The fix is available in PraisonAI 4.6.58. See the GitHub Release v4.6.58 and the GitHub Security Advisory GHSA-pvph-5j39-v8qc. The remediating changes are in commit 2f9677a, which replaces the prefix-based origin check, adds bearer-token authorization, and sanitizes user-controlled path components.

Workarounds

Bind the PraisonAI server to 127.0.0.1 and place it behind a reverse proxy that performs strict, exact-match origin validation.
Require an authentication token on every MCP request and reject anonymous tools/call invocations at the proxy layer.
Block or reject requests to the MCP endpoint that carry Content-Type: text/plain, since legitimate JSON-RPC clients send application/json.

bash

# Example: upgrade PraisonAI to the fixed release
pip install --upgrade 'praisonai>=4.6.58'

# Example: enforce an auth token via environment configuration
export PRAISONAI_AUTH_TOKEN="$(openssl rand -hex 32)"

# Example: nginx snippet enforcing exact-match Origin before proxying to PraisonAI
# if ($http_origin !~* '^https?://(localhost|127\.0\.0\.1)(:[0-9]+)?$') { return 403; }