CVE-2026-57112: PraisonAI Auth Bypass Vulnerability

CVE-2026-57112 Overview

CVE-2026-57112 is a missing authentication vulnerability [CWE-306] in PraisonAI, a multi-agent teams system. The flaw affects praisonaiagents versions 0.6.0 through 1.6.58 and PraisonAI versions 3.10.0 through 4.6.58. The ToolsMCPServer.run_sse() function in src/praisonai-agents/praisonaiagents/mcp/mcp_server.py mounts SseServerTransport on the legacy /sse and /messages/ endpoints without enforcing default Host, Origin, or authentication controls. Attackers can leverage DNS rebinding from a malicious website to reach local or internal SSE servers, enumerate registered tools, and invoke them with the server user's privileges.

Critical Impact
A malicious website can pivot through a victim's browser via DNS rebinding to invoke arbitrary registered MCP tools on a local or internal PraisonAI SSE server, executing operations with the server user's privileges.

Affected Products

praisonaiagents 0.6.0 through 1.6.58
PraisonAI 3.10.0 through 4.6.58
Deployments exposing the legacy /sse and /messages/ MCP endpoints

Discovery Timeline

2026-09-15 - CVE-2026-57112 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-57112

Vulnerability Analysis

The vulnerability resides in the legacy Server-Sent Events (SSE) transport wrapper used by PraisonAI's Model Context Protocol (MCP) server. ToolsMCPServer.run_sse() mounts SseServerTransport on /sse and /messages/ endpoints and starts a Starlette application without validating the incoming Host or Origin headers. No authentication token is required to reach the transport. The newer Streamable HTTP transport does reject hostile Origin headers, which contains the flaw to the legacy SSE wrapper.

An attacker hosts a malicious page that a victim on an internal network visits. Through DNS rebinding, the browser is coerced into issuing same-origin requests against a reachable PraisonAI SSE endpoint on localhost or an internal address. Because the server accepts attacker-controlled Host and Origin headers, the page can enumerate registered tools and invoke them, executing agent actions with the privileges of the process owner.

Root Cause

The root cause is missing authentication [CWE-306] combined with absent Host/Origin allow-listing on the legacy SSE endpoints. run_sse() binds the transport without wiring in any middleware that enforces authenticated sessions or validates request origin, leaving the endpoints exposed to cross-origin abuse through browser-mediated attacks.

Attack Vector

The attack is network-based but requires user interaction: the victim must load an attacker-controlled page while a vulnerable PraisonAI SSE server is reachable from their host. DNS rebinding then bridges the browser to the local or internal endpoint, allowing the attacker to POST tool invocations through /messages/ and receive streamed responses over /sse.

python

# Post-patch: environment-driven SSE security wiring
# Source: https://github.com/MervinPraison/PraisonAI/commit/2adfe7e8323f6deec66925cf15a885b6238895e9
def load_sse_security_from_env():
    """Load optional SSE security settings from environment."""
    import os

    token = os.environ.get("MCP_SSE_AUTH_TOKEN") or os.environ.get("MCP_AUTH_TOKEN")
    origins_raw = os.environ.get("MCP_SSE_ALLOWED_ORIGINS")
    if not token and not origins_raw:
        return None, None

    origins = (
        [origin.strip() for origin in origins_raw.split(",") if origin.strip()]
        if origins_raw
        else None
    )
    config = SecurityConfig(
        require_auth=bool(token),
        validate_origin=origins is not None,
        allowed_origins=origins or SecurityConfig().allowed_origins,
    )
    return config, token


def build_sse_security_app(app, security: Optional["SecurityConfig"] = None):
    """Wrap a Starlette app with SSE security middleware when configured."""
    config = security

The patch introduces optional token-based authentication and origin allow-listing via environment variables, and wraps the Starlette SSE application with security middleware when configured. See the GitHub commit for the full change set.

Detection Methods for CVE-2026-57112

Indicators of Compromise

Unexpected HTTP requests to /sse or /messages/ endpoints containing external or spoofed Host and Origin headers.
MCP tool invocations originating from browser user-agents rather than trusted agent clients.
Rapid sequential tools/list and tools/call JSON-RPC methods in SSE session logs from a single client.

Detection Strategies

Instrument reverse proxies fronting PraisonAI to log and alert on requests to /sse and /messages/ where Host does not match an allow-listed value.
Correlate outbound DNS resolutions with rapid TTL changes against the same hostname, a signature of DNS rebinding.
Baseline expected MCP client IPs and flag SSE connections from unexpected sources, especially loopback interfaces reached from browsers.

Monitoring Recommendations

Enable request logging on the Starlette application and forward to a centralized log store for retention and search.
Monitor process telemetry on hosts running PraisonAI for tool invocations that spawn unexpected child processes.
Track the installed versions of praisonaiagents and PraisonAI across the environment to identify hosts still on affected releases.

How to Mitigate CVE-2026-57112

Immediate Actions Required

Upgrade praisonaiagents to 1.6.59 or later and PraisonAI to 4.6.59 or later, which contain the initial remediation.
Restrict the SSE server to loopback binding (127.0.0.1) using the existing get_bind_address() configuration where remote access is not required.
Set MCP_SSE_AUTH_TOKEN and MCP_SSE_ALLOWED_ORIGINS environment variables to enable token authentication and origin validation on the SSE transport.

Patch Information

The initial fix ships in praisonaiagents 1.6.59 and PraisonAI 4.6.59. Review the GitHub Release v4.6.59 notes and the GitHub Security Advisory GHSA-vmf9-xx9w-86wx for full remediation guidance.

Workarounds

Migrate deployments from the legacy SSE transport to the Streamable HTTP transport, which already rejects hostile Origin headers.
Place PraisonAI behind an authenticating reverse proxy that enforces Host and Origin header allow-listing before requests reach /sse and /messages/.
Block browser reachability by firewalling the SSE port from user workstations and DNS-pinning trusted client hostnames.

bash

# Configuration example: enable SSE authentication and origin allow-list
export MCP_SSE_AUTH_TOKEN="$(openssl rand -hex 32)"
export MCP_SSE_ALLOWED_ORIGINS="https://agents.internal.example.com"
# Bind to loopback only when remote access is not required
# ToolsMCPServer.get_bind_address() will return 127.0.0.1 when bind_localhost_only=True