CVE-2026-57139: PraisonAI Authentication Bypass Vulnerability

CVE-2026-57139 Overview

CVE-2026-57139 is a missing authentication vulnerability [CWE-306] in PraisonAI, a multi-agent teams system. The flaw resides in MCPServer.startHttp() located at src/praisonai-ts/src/mcp/server.ts. The function binds without a host restriction and forwards every HTTP POST request to handleRequest() without authentication or authorization. Any network client that can reach the exposed port can invoke tools/list, tools/call, resources/read, or prompts/get. Registered handlers then execute with server-side credentials and process privileges, or disclose registered data. The vulnerability affects PraisonAI versions from 1.5.0 until 1.7.2, with an initial remediation shipped in version 1.7.2.

Critical Impact
Unauthenticated network attackers can invoke registered tools and read resources on exposed PraisonAI MCP servers, executing code with server-side credentials.

Affected Products

PraisonAI 1.5.0 through 1.7.1 (praisonai-ts MCP server component)
PraisonAI package versions prior to 4.6.60 (Docker images)
Any deployment exposing MCPServer.startHttp() on a reachable network interface

Discovery Timeline

2026-09-15 - CVE-2026-57139 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-57139

Vulnerability Analysis

The Model Context Protocol (MCP) server in PraisonAI exposes an HTTP transport for tool invocation, resource reads, and prompt retrieval. The startHttp() method starts the listener without binding to a specific host and without registering any authentication middleware. Every incoming HTTP POST is forwarded directly to handleRequest(), which dispatches to the registered MCP handlers.

Because the handlers run inside the server process, invoked tools inherit the process credentials, environment variables, and any API keys the PraisonAI deployment holds. This turns a network-reachable MCP endpoint into an unauthenticated remote command surface for the agent framework.

Root Cause

The root cause is missing authentication for a critical function [CWE-306]. MCPServer.startHttp() does not validate the caller, does not restrict the bind address to loopback, and does not require a shared secret or bearer token. The design assumes trusted local usage but ships as a network listener.

Attack Vector

An attacker with network reachability to the MCP port sends crafted JSON-RPC style POST requests. Calling tools/list enumerates registered handlers, tools/call executes them with arbitrary arguments, resources/read discloses registered data, and prompts/get returns stored prompt content. No credentials or user interaction are required.

No public proof-of-concept exploit is currently listed for CVE-2026-57139. See the GitHub Security Advisory GHSA-j4f3-55x4-r6q2 for advisory details.

text

# Docker image dependency bump aligning with the upstream fix
# Source: https://github.com/MervinPraison/PraisonAI/commit/709a0387853709a5e2f2c34680fa64cada252c27
 RUN pip install --no-cache-dir \
     praisonai_tools \
-    "praisonai>=4.6.59" \
+    "praisonai>=4.6.60" \
     "praisonai[chat]" \
     "embedchain[github,youtube]"

Detection Methods for CVE-2026-57139

Indicators of Compromise

Unexpected inbound HTTP POST traffic to the PraisonAI MCP listener port from non-loopback sources
Log entries showing calls to tools/list, tools/call, resources/read, or prompts/get from unknown clients
MCP handlers executing outside expected orchestration windows or with unusual argument payloads

Detection Strategies

Inventory hosts running PraisonAI and identify processes invoking MCPServer.startHttp() bound to 0.0.0.0 or a public interface
Alert on JSON-RPC style requests to the MCP endpoint originating from outside the agent orchestration subnet
Correlate MCP tool invocations with expected agent workflows to surface orphaned or attacker-driven calls

Monitoring Recommendations

Capture HTTP access logs on the MCP port and forward to a centralized SIEM for retention
Monitor outbound activity from PraisonAI processes for signs of credential misuse triggered through tools/call
Track the installed praisonai and praisonai-ts versions across your fleet and alert on versions between 1.5.0 and 1.7.1

How to Mitigate CVE-2026-57139

Immediate Actions Required

Upgrade PraisonAI to version 1.7.2 or later, which contains the initial remediation for CVE-2026-57139
For Docker deployments, rebuild images with praisonai>=4.6.60 as shown in the upstream commit
Restrict network exposure of the MCP port to loopback or a trusted management subnet via firewall or security group rules
Rotate any credentials, API keys, or secrets that the PraisonAI process could have exposed through registered tool handlers

Patch Information

An initial remediation was released in PraisonAI version 1.7.2. The corresponding Docker image update is tracked in GitHub Release v4.6.60 and the fix commit is available at GitHub commit 709a0387. Review the GitHub Security Advisory GHSA-j4f3-55x4-r6q2 for the complete vendor guidance.

Workarounds

Bind the MCP HTTP listener to 127.0.0.1 and reach it only through an authenticated reverse proxy
Place the MCP endpoint behind a reverse proxy that enforces mutual TLS or bearer-token authentication
Disable the HTTP transport where possible and use a local transport (stdio) between the orchestrator and MCP tools
Apply network segmentation so only the agent runtime host can reach the MCP port

bash

# Example: restrict PraisonAI MCP port (default 8080) to loopback with iptables
sudo iptables -A INPUT -p tcp --dport 8080 ! -i lo -j DROP
sudo iptables -A INPUT -p tcp --dport 8080 -i lo -j ACCEPT

# Verify installed version is patched
pip show praisonai | grep -i version