Executive brief
PraisonAI is a multi-agent AI system that coordinates intelligent agents to perform complex tasks. The default configuration exposes an API endpoint that accepts arbitrary commands without authentication and executes them as the service account, allowing any network-accessible attacker to run arbitrary code on the server where PraisonAI is deployed.
Technical details
PraisonAI's UI host exposes a POST /api/mcp/connect endpoint without mandatory authentication. The endpoint accepts caller-controlled command and args parameters that are directly passed to StdioMCPClient to spawn local processes. Because the UI service binds to 0.0.0.0 by default, an unauthenticated remote attacker can reach this endpoint over the network and execute arbitrary commands as the service account, even if the subsequent MCP handshake fails. The vulnerability is due to missing input validation and access controls on the endpoint. A fix was released in version 4.6.59 that hardens input validation and enforces access controls.
Affected products
- Mervin Praison PraisonAI prior to 4.6.59
Timeline
- 2026-09-14: disclosed: CVE-2026-57124 published on NVD
- 2026-06-13: patched: Fix committed (version 4.6.59 released 2026-06-17)