CVE-2026-61427: PraisonAI Auth Bypass Vulnerability

CVE-2026-61427 Overview

CVE-2026-61427 is an authentication bypass vulnerability in PraisonAI versions before 4.6.78. The flaw affects the Model Context Protocol (MCP) HTTP-stream transport, which exposes tool execution endpoints without authentication by default. The --api-key CLI option defaults to None, and the server only enforces Authorization/Bearer checks when an API key is explicitly configured. Unauthenticated clients can initialize sessions, enumerate tools via tools/list, and invoke them via tools/call. The dispatcher also forwards tool-call arguments to handlers without validating them against the advertised inputSchema, compounding the risk.

Critical Impact
An unauthenticated attacker with network access to a PraisonAI MCP HTTP-stream server can enumerate and invoke arbitrary registered tools, leading to unauthorized data access, tool abuse, and potential downstream code execution.

Affected Products

PraisonAI versions prior to 4.6.78
PraisonAI MCP server running with --transport http-stream
Deployments where operators bind the server to a network-accessible interface (e.g., --host 0.0.0.0)

Discovery Timeline

2026-07-15 - CVE-2026-61427 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-61427

Vulnerability Analysis

The vulnerability stems from insecure default configuration in the PraisonAI MCP HTTP-stream transport. When an operator launches the server with praisonai mcp serve --transport http-stream and omits the --api-key option, the server accepts every incoming request without validating an Authorization header. The MCP handshake, tool discovery, and tool invocation endpoints all become reachable to any client that can connect.

Once a session is initialized, an attacker can call tools/list to enumerate every registered tool and its metadata. The attacker can then issue tools/call requests to execute any of those tools. Because PraisonAI is an agentic framework, registered tools frequently include file access, shell execution helpers, HTTP fetchers, and integrations with third-party services. Invoking these tools without authorization can lead to data exfiltration, server-side request forgery, or arbitrary command execution depending on the deployed toolset.

A second defect amplifies the impact. The dispatcher forwards arguments provided in tools/call directly to the underlying handler without validating them against the tool's advertised inputSchema. This weakens defense-in-depth and allows malformed or unexpected inputs to reach tool handlers, mapped to [CWE-20] Improper Input Validation.

Root Cause

The authorization check is conditional on the presence of a configured API key. Because --api-key defaults to None, the conditional never triggers, and no Authorization/Bearer enforcement occurs. Additionally, no Origin header validation is applied, so browsers and cross-origin clients are not restricted. Argument validation against inputSchema is missing at the dispatcher layer.

Attack Vector

Exploitation requires network reachability to the MCP HTTP-stream endpoint. The server binds to 127.0.0.1 by default, limiting exposure to local clients. However, operators who intentionally bind to 0.0.0.0 or another routable address to serve remote agents expose the endpoint to any attacker on that network. The attacker sends an unauthenticated MCP initialization request, then issues tools/list and tools/call JSON-RPC messages to enumerate and execute tools. No credentials, user interaction, or Origin header are required.

Refer to the GitHub Security Advisory GHSA-hc5v-gxvj-58wh and the VulnCheck Advisory on Authentication Bypass for protocol-level details.

Detection Methods for CVE-2026-61427

Indicators of Compromise

HTTP requests to the MCP endpoint containing JSON-RPC methods initialize, tools/list, or tools/call without an accompanying Authorization: Bearer header
PraisonAI process arguments containing mcp serve --transport http-stream combined with --host 0.0.0.0 and no --api-key value
Unexpected outbound network connections or file access initiated by the PraisonAI process shortly after inbound MCP traffic

Detection Strategies

Inspect process command lines for praisonai mcp serve invocations that omit --api-key and bind to non-loopback interfaces.
Monitor HTTP access logs on PraisonAI MCP ports for JSON-RPC method names typical of MCP handshakes originating from unauthenticated sources.
Alert on any tools/call request accepted by a server whose configuration lacks an API key.

Monitoring Recommendations

Forward PraisonAI application logs and host process telemetry to a centralized analytics platform for correlation with network flow data.
Track listening sockets on hosts running PraisonAI to detect changes from 127.0.0.1 binding to externally reachable addresses.
Baseline expected tool invocation patterns and alert on anomalies such as unusual argument payloads or high-frequency tools/list enumeration.

How to Mitigate CVE-2026-61427

Immediate Actions Required

Upgrade PraisonAI to version 4.6.78 or later on all hosts running the MCP server.
Audit running instances for praisonai mcp serve --transport http-stream invocations that lack --api-key or bind to non-loopback interfaces.
Rotate any secrets, tokens, or credentials that were accessible to tools registered on exposed MCP servers.

Patch Information

The fix is available in PraisonAI 4.6.78. See the GitHub Security Advisory GHSA-hc5v-gxvj-58wh for release notes and the corresponding code changes that enforce authentication and validate tool-call arguments against the declared inputSchema.

Workarounds

Always launch the MCP server with a strong --api-key value and require clients to send Authorization: Bearer <token> on every request.
Keep the server bound to 127.0.0.1 unless remote access is strictly required, and place any remote-facing deployment behind an authenticating reverse proxy.
Restrict network access to the MCP port using host-based firewalls or network ACLs limited to trusted client IP ranges.
Minimize the set of tools registered on the MCP server to reduce the blast radius of any unauthorized invocation.

bash

# Configuration example: start PraisonAI MCP server with authentication and loopback binding
export PRAISONAI_MCP_API_KEY="$(openssl rand -hex 32)"
praisonai mcp serve \
  --transport http-stream \
  --host 127.0.0.1 \
  --port 8080 \
  --api-key "$PRAISONAI_MCP_API_KEY"

# Client requests must include the bearer token
curl -H "Authorization: Bearer $PRAISONAI_MCP_API_KEY" \
     -H "Content-Type: application/json" \
     --data '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \
     http://127.0.0.1:8080/mcp