PraisonAI praisonaiagents missing authentication in MCP SSE transport

Executive brief

PraisonAI is an AI agent framework that allows developers to expose tools (like shell access or file management) over a network. A vulnerability in its server component allows anyone on the network to execute these tools without any authentication. This could lead to complete system takeover if powerful tools are enabled, and it also allows malicious websites to attack the server through a user's browser.

Technical details

The Model Context Protocol (MCP) Server-Sent Events (SSE) transport in PraisonAI fails to implement authentication or origin validation. Specifically, the `run_sse` and `launch_tools_mcp_server` functions default to binding on `0.0.0.0` and initialize the Starlette application without security middleware. Although a security module (`mcp_security.py`) exists in the codebase to handle origin validation and authentication, it is never called by the transport layer. An unauthenticated remote attacker can invoke any registered tool via JSON-RPC. Additionally, the lack of Origin-header validation makes the server vulnerable to DNS rebinding attacks, allowing cross-origin tool execution from a victim's browser. This is patched in version 1.6.59.

Affected products

• MervinPraison/PraisonAI praisonaiagents < 1.6.59

Timeline

• 2026-06-17: disclosed
• 2026-06-18: advisory
• 1.6.59: patched

References

• https://api.github.com/users/sour-exploit
• https://github.com/sour-exploit
• https://api.github.com/users/sour-exploit/gists%7B/gist_id%7D
• https://api.github.com/users/sour-exploit/repos
• https://avatars.githubusercontent.com/u/288231323?v=4
• https://api.github.com/users/sour-exploit/events%7B/privacy%7D