Executive brief
PraisonAI is an open-source AI agent platform that includes an HTTP server for running agent tasks locally. The HTTP server's origin validation is bypassed by a simple string prefix match, allowing an attacker to forge requests from any domain beginning with "localhost" or "127.0.0.1" (e.g., localhost.attacker.com). Combined with the lack of default authentication and the ability to send JSON payloads without browser preflight checks, an attacker can inject malicious rules that persist across all future agent runs, leading to silent exfiltration of secrets, SSH keys, and API credentials from the victim's machine.
Technical details
The vulnerability is a multi-factor auth/validation bypass in PraisonAI's Model Context Protocol (MCP) HTTP-stream transport. The root cause is in transports/http_stream.py: the _validate_origin() method uses startswith() instead of a proper parsed-origin comparison (scheme, host, port), so "http://localhost.attacker.com".startswith("http://localhost") returns True and accepts the malicious origin. Three contributing factors make this exploitable from a web page: (1) no API key is set by default (cli.py --api-key defaults to None), and the auth check is entirely skipped when api_key is falsy; (2) the server parses request bodies as JSON regardless of Content-Type, allowing CORS simple requests (Content-Type: text/plain) that require no OPTIONS preflight; (3) the tools/call dispatcher does not require a session header, so unauthenticated calls proceed directly to tool handlers. The attack vector is network and requires no user interaction beyond visiting an attacker-controlled web page. An attacker registers a subdomain such as localhost.attacker.com, sends a crafted POST request with spoofed Origin header and text/plain Content-Type, and invokes praisonai.rules.create to write a malicious rule file into ~/.praison/rules with activation "always", ensuring the attacker's instructions (e.g., exfiltrate ~/.ssh/id_rsa) are silently executed on every subsequent agent run. Patched in version 4.6.58.
Affected products
- MervinPraison PraisonAI < 4.6.58
Timeline
- 2026-06-13: disclosed
- 2026-08-25: advisory
- 2026-08-25: patched: Version 4.6.58