CVE-2026-57124: PraisonAI UI RCE Vulnerability

CVE-2026-57124 Overview

PraisonAI is a multi-agent teams system used to orchestrate AI agent workflows. Versions prior to 4.6.59 expose the POST /api/mcp/connect endpoint in the default UI host applications without mandatory authentication. The endpoint accepts caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI binds to 0.0.0.0 by default, any network-reachable client can execute commands under the UI service account, even when the subsequent Model Context Protocol (MCP) handshake fails. The flaw is classified as OS Command Injection [CWE-78] and is fixed in version 4.6.59.

Critical Impact
Unauthenticated network attackers can execute arbitrary operating system commands on hosts running vulnerable PraisonAI UI deployments.

Affected Products

PraisonAI versions prior to 4.6.59
PraisonAIUI default host application
Deployments exposing the MCP connect endpoint on 0.0.0.0

Discovery Timeline

2026-09-14 - CVE-2026-57124 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-57124

Vulnerability Analysis

The vulnerability resides in the PraisonAIUI host application's MCP integration layer. The POST /api/mcp/connect route accepts a JSON body containing command and args fields intended to launch a local MCP server process over standard input/output. PraisonAIUI forwards those values directly to StdioMCPClient, which spawns a child process using the attacker-supplied executable and arguments.

Two compounding weaknesses make the flaw reachable. First, the endpoint lacks mandatory authentication in default configurations. Second, the UI service binds to 0.0.0.0, exposing the API on all network interfaces rather than restricting it to 127.0.0.1. The process launch occurs before the MCP handshake completes, so a failed handshake does not prevent execution.

Root Cause

The root cause is missing authentication and missing input validation on a privileged process-spawning endpoint. The endpoint treats command and args as trusted, delegating them to the process launcher without allowlisting binaries, sanitizing arguments, or requiring caller identity.

Attack Vector

An attacker sends an unauthenticated HTTP POST request to /api/mcp/connect on any reachable PraisonAIUI instance. The request payload specifies the binary to execute and its arguments. PraisonAIUI spawns the process under the UI service account, producing full command execution on the host regardless of subsequent MCP protocol errors.

python

# Patch excerpt: src/praisonai-agents/praisonaiagents/mcp/mcp_security.py
# Adds optional SSE authentication and origin validation loaded from env vars.
def load_sse_security_from_env():
    """Load optional SSE security settings from environment."""
    import os

    token = os.environ.get("MCP_SSE_AUTH_TOKEN") or os.environ.get("MCP_AUTH_TOKEN")
    origins_raw = os.environ.get("MCP_SSE_ALLOWED_ORIGINS")
    if not token and not origins_raw:
        return None, None

    origins = (
        [origin.strip() for origin in origins_raw.split(",") if origin.strip()]
        if origins_raw
        else None
    )
    config = SecurityConfig(
        require_auth=bool(token),
        validate_origin=origins is not None,
        allowed_origins=origins or SecurityConfig().allowed_origins,
    )
    return config, token
# Source: https://github.com/MervinPraison/PraisonAI/commit/2adfe7e8323f6deec66925cf15a885b6238895e9

Detection Methods for CVE-2026-57124

Indicators of Compromise

HTTP POST requests to /api/mcp/connect from external or non-administrative source addresses.
Child processes spawned by the PraisonAIUI service account with unexpected binaries such as sh, bash, powershell.exe, curl, or wget.
Outbound network connections from PraisonAI hosts to unfamiliar command-and-control infrastructure shortly after MCP connect requests.

Detection Strategies

Inspect application and reverse-proxy access logs for POST requests to /api/mcp/connect lacking authentication headers.
Monitor process creation telemetry for the PraisonAIUI parent process launching shells or scripting interpreters.
Alert on PraisonAI listeners bound to 0.0.0.0 on non-loopback interfaces during host inventory scans.

Monitoring Recommendations

Enable centralized logging of all PraisonAIUI HTTP requests and forward events to a security data lake for retention and search.
Baseline expected child processes for the PraisonAI service and generate alerts on deviations.
Track PraisonAI package versions across your environment to identify hosts still running releases prior to 4.6.59.

How to Mitigate CVE-2026-57124

Immediate Actions Required

Upgrade all PraisonAI installations to version 4.6.59 or later without delay.
Remove exposure of the PraisonAIUI service from untrusted networks and place it behind an authenticated reverse proxy.
Rotate credentials, tokens, and secrets accessible to the PraisonAIUI service account on any host that was network-reachable.

Patch Information

The fix is available in PraisonAI v4.6.59. The upstream changes are documented in the GitHub commit 2adfe7e and the GHSA-p75f-6fp4-p57w advisory. The patch hardens input validation, enforces access controls, and introduces optional SSE authentication and allowed-origin configuration through the MCP_SSE_AUTH_TOKEN and MCP_SSE_ALLOWED_ORIGINS environment variables.

Workarounds

Bind the PraisonAIUI service to 127.0.0.1 so the MCP connect endpoint is not reachable from external interfaces.
Set MCP_SSE_AUTH_TOKEN and MCP_SSE_ALLOWED_ORIGINS to require authentication and restrict cross-origin access when upgrading.
Apply host firewall or network policy rules that block inbound access to the PraisonAI listener from all non-administrative sources.

bash

# Restrict PraisonAIUI to loopback and enable SSE authentication
export MCP_SSE_AUTH_TOKEN="$(openssl rand -hex 32)"
export MCP_SSE_ALLOWED_ORIGINS="https://praisonai.internal.example.com"

# Example firewall rule to block external access to the default UI port
sudo iptables -A INPUT -p tcp --dport 8080 ! -s 127.0.0.1 -j DROP