CVE-2026-57123: PraisonAI Authentication Bypass Vulnerability

CVE-2026-57123 Overview

CVE-2026-57123 is a missing authentication vulnerability [CWE-306] in PraisonAI, a multi-agent teams system. Versions of praisonaiagents prior to 1.6.59 expose Model Context Protocol (MCP) server endpoints without invoking available security controls. The ToolsMCPServer.run_sse and launch_tools_mcp_server functions bind to 0.0.0.0 and create /sse and /messages/ routes without enforcing the SecurityConfig authentication, origin-validation, or DNS-rebinding protections. Any reachable network client can enumerate and invoke registered tools. A browser can also target a local instance through DNS rebinding attacks.

Critical Impact
Unauthenticated attackers can invoke registered file, shell, and code-execution tools on exposed PraisonAI MCP servers, leading to remote code execution on the host system.

Affected Products

PraisonAI praisonaiagents package versions prior to 1.6.59
Deployments using ToolsMCPServer.run_sse
Deployments using launch_tools_mcp_server

Discovery Timeline

2026-09-14 - CVE CVE-2026-57123 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-57123

Vulnerability Analysis

The vulnerability originates in the PraisonAI MCP server-sent events (SSE) transport layer. The ToolsMCPServer.run_sse and launch_tools_mcp_server entry points instantiate an SSE server that binds to 0.0.0.0, exposing /sse and /messages/ endpoints on all network interfaces. While the codebase provides a SecurityConfig class supporting authentication tokens, origin validation, and DNS-rebinding protections, these controls are not wired into the SSE launch path.

Any client with network reachability to the listening port can query the MCP endpoint to enumerate registered tools and invoke them without credentials. Because MCP tool registrations frequently include file I/O, shell command execution, and code execution primitives, invocation converts trivially to arbitrary command execution on the host.

The DNS rebinding vector expands the attack surface further. A victim browsing an attacker-controlled site can execute JavaScript that rebinds a hostname to 127.0.0.1, then issues requests to the local MCP server bypassing the same-origin policy in the absence of Origin header validation.

Root Cause

The root cause is missing authentication for a critical function [CWE-306]. The SSE server bootstrap path never calls into the existing SecurityConfig middleware, and the default bind address exposes the service network-wide rather than restricting it to loopback.

Attack Vector

Exploitation requires only network reachability to the MCP port, or in the DNS rebinding case, a victim visiting a malicious web page while a PraisonAI MCP server runs on their machine. No authentication, user interaction with the agent, or prior access is required.

python

# Security patch in src/praisonai-agents/praisonaiagents/mcp/mcp_security.py
# Adds environment-driven SecurityConfig loading and Starlette middleware wrapper

    def get_bind_address(self) -> str:
        """Get recommended bind address based on config."""
        return "127.0.0.1" if self.bind_localhost_only else "0.0.0.0"


def load_sse_security_from_env():
    """Load optional SSE security settings from environment."""
    import os

    token = os.environ.get("MCP_SSE_AUTH_TOKEN") or os.environ.get("MCP_AUTH_TOKEN")
    origins_raw = os.environ.get("MCP_SSE_ALLOWED_ORIGINS")
    if not token and not origins_raw:
        return None, None

    origins = (
        [origin.strip() for origin in origins_raw.split(",") if origin.strip()]
        if origins_raw
        else None
    )
    config = SecurityConfig(
        require_auth=bool(token),
        validate_origin=origins is not None,
        allowed_origins=origins or SecurityConfig().allowed_origins,
    )
    return config, token


def build_sse_security_app(app, security: Optional["SecurityConfig"] = None):
    """Wrap a Starlette app with SSE security middleware when configured."""
    config = security
# Source: https://github.com/MervinPraison/PraisonAI/commit/2adfe7e8323f6deec66925cf15a885b6238895e9

Detection Methods for CVE-2026-57123

Indicators of Compromise

Unexpected inbound connections to /sse or /messages/ endpoints on hosts running praisonaiagents
Process telemetry showing shell, file, or interpreter processes spawned as children of the PraisonAI runtime
Outbound network requests originating from tool invocations that do not correspond to legitimate agent workflows
HTTP requests to local PraisonAI ports containing external Origin or Host header values indicative of DNS rebinding

Detection Strategies

Inventory hosts running praisonaiagents and identify any listeners bound to 0.0.0.0 on MCP SSE ports
Alert on unauthenticated HTTP requests to /sse or /messages/ paths from non-loopback source addresses
Correlate MCP server access logs with subsequent process creation events to detect tool-driven command execution

Monitoring Recommendations

Monitor for praisonaiagents package versions below 1.6.59 across development and production environments
Track network egress from hosts running PraisonAI for anomalous destinations following inbound MCP traffic
Log all requests to MCP endpoints and retain Origin, Host, and authentication header values for review

How to Mitigate CVE-2026-57123

Immediate Actions Required

Upgrade praisonaiagents to version 1.6.59 or later as published in GitHub Release v4.6.59
Set the MCP_SSE_AUTH_TOKEN environment variable to require token authentication on the SSE transport
Configure MCP_SSE_ALLOWED_ORIGINS to restrict browser origins permitted to reach the MCP endpoints
Restrict the MCP listener to 127.0.0.1 by enabling bind_localhost_only in the SecurityConfig

Patch Information

The fix ships in praisonaiagents 1.6.59. The commit 2adfe7e introduces load_sse_security_from_env and build_sse_security_app helpers that wire the existing SecurityConfig into the SSE launch path. The patch also hardens is_yaml_approved in the approval registry to reject tools classified as critical risk level even when YAML-approved. Details are documented in GHSA-x227-pf99-vffg.

Workarounds

Place the MCP listener behind a reverse proxy that enforces authentication and origin validation until upgrading is possible
Use host-based firewall rules to restrict inbound connections to /sse and /messages/ to trusted source addresses only
Avoid registering shell, file, or code-execution tools on any PraisonAI instance that cannot be immediately patched

bash

# Configuration example: enable authentication and origin controls via environment
export MCP_SSE_AUTH_TOKEN="$(openssl rand -hex 32)"
export MCP_SSE_ALLOWED_ORIGINS="https://trusted.internal.example.com"

# Upgrade to the patched release
pip install --upgrade 'praisonaiagents>=1.6.59'