# CVE-2026-57139: PraisonAI MCPServer unauthenticated HTTP tools exposure

Source: https://junglewise.ai/threats/cve-2026-57139-praisonai-mcpserver-unauthenticated-http-tools-exposure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-57139 · Severity: critical · CVSS 9.8 · Published 2026-09-15

PraisonAI's npm MCPServer is a TypeScript library that exposes AI model tools and resources over HTTP JSON-RPC. The HTTP server binds to all network interfaces and accepts any incoming request without authentication, allowing unauthenticated network clients to list and invoke registered server-side tools, read resources, and retrieve prompts. This could enable unauthorized access to sensitive operations and data.

Vendors: [PraisonAI](https://junglewise.ai/threats/vendors/praisonai).

## Quick answers

**Is CVE-2026-57139 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57139 being exploited in the wild.

**How severe is CVE-2026-57139?** Critical severity, with a CVSS score of 9.8, published 15 September 2026.

**Which products and versions are affected?** PraisonAI MCPServer >= 1.5.0, <= 1.7.1.

**Is there a fix for CVE-2026-57139?** A patch was published on 2026-06-17: Fix released in version 1.7.2 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57139 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-57139?** Check whether you run PraisonAI MCPServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The MCPServer HTTP transport lacks authentication and authorization checks. The startHttp() method parses all incoming POST requests and forwards them directly to handleRequest() without validating an Authorization header. The handleRequest() dispatcher unconditionally processes sensitive MCP methods including tools/call, resources/read, prompts/get, and tools/list. Additionally, the http.createServer().listen(port) call binds to the unspecified address (:: on IPv6 or 0.0.0.0 on IPv4), exposing the service on all network interfaces rather than localhost. The package includes an MCPSecurity class with authentication and authorization capabilities, but it is never integrated into the HTTP request path. Affected versions 1.5.0 through 1.7.1 are vulnerable; version 1.7.2 and later include patches.

## Affected products

- PraisonAI MCPServer >= 1.5.0, <= 1.7.1

## Identifiers

- CVE-2026-57139
- GHSA-j4f3-55x4-r6q2

## Timeline

- 2026-06-18: disclosed
- 2026-06-17: patched: Fix released in version 1.7.2 and later

## References

- [https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-j4f3-55x4-r6q2](https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-j4f3-55x4-r6q2)
- [https://github.com/MervinPraison/PraisonAI](https://github.com/MervinPraison/PraisonAI)