CVE-2026-57123: PraisonAI MCP Server Exposes Unauthenticated Tool Access

Overview

A critical missing-authentication vulnerability has been disclosed in PraisonAI, the open-source multi-agent teams framework maintained by MervinPraison. Tracked as CVE-2026-57123 (CVSS 9.8), the flaw sits in the praisonaiagents package's Model Context Protocol (MCP) tools server: the legacy SSE transport exposed by ToolsMCPServer.run_sse and launch_tools_mcp_server binds to 0.0.0.0 and stands up /sse and /messages/ routes without ever invoking the authentication, origin-validation, or DNS-rebinding protections the project already ships.

In practice, any host that can reach the listening port — and, via DNS rebinding, any malicious website a victim happens to visit while a local instance is running — can enumerate every tool registered on that server and invoke it with no credentials at all. Impact scales directly with whatever tools were registered: shell execution, file read/write, and arbitrary code-execution tools are common in PraisonAI agent deployments, turning this into a straightforward path to full host compromise.

Technical Details

How It Works

PraisonAI's MCP tooling layer ships a dedicated security module, mcp/mcp_security.py, with functions purpose-built for exactly this scenario: is_valid_origin, is_potential_dns_rebinding, validate_auth_header, and a SecurityConfig object that defaults to bind_localhost_only=True and supports require_auth=True with a bearer token read from MCP_SSE_AUTH_TOKEN.

The problem is that none of it is wired up. When a server is started via ToolsMCPServer.run_sse() or the launch_tools_mcp_server(transport="sse") convenience wrapper, the underlying Starlette application is constructed with only debug and routes — no middleware for authentication, no Origin header check, no Host validation. The SecurityConfig helpers exist and are documented, but the transport code path never calls them, making the security module effectively dead code for anyone relying on the defaults. Combined with the 0.0.0.0 default bind address, the result is a fully open /sse endpoint (and its companion /messages/ POST endpoint) reachable from anywhere the network allows:

# List and invoke tools with zero credentials
curl -N http://TARGET:8080/sse
# followed by unauthenticated JSON-RPC calls against /messages/

Because there's no Origin or Host validation, the same open door works from inside a browser too: if a victim with a local PraisonAI SSE server running visits an attacker-controlled page, DNS rebinding lets that page's JavaScript resolve a lookalike hostname to 127.0.0.1 after the initial same-origin check, and drive the same unauthenticated tool calls against the victim's own machine. This mirrors the broader class of issue described in the upstream MCP Python SDK advisory (GHSA-9h52-p55h-vw2f), which flags unauthenticated local SSE/HTTP MCP servers without rebinding protection as browser-exploitable by design. Notably, PraisonAI's newer Streamable HTTP transport already enforces an Origin guard — it's specifically the older SSE sibling path that was left unprotected.

Impact Assessment

Who Is At Risk

• Any deployment that starts a PraisonAI Tools MCP server over SSE (run_sse / launch_tools_mcp_server) on a version before 1.6.59, whether intentionally exposed for remote agent access or "just for local dev"
• Developers running a local SSE MCP server for testing while registered tools include shell, filesystem, or code-execution capability — these are exploitable purely by visiting a malicious webpage, via DNS rebinding
• Production or internal automation stacks that bound the server to 0.0.0.0 (the default) on a host reachable from a shared network, cloud VPC, or the public internet
• Organizations that registered high-impact tools (shell commands, arbitrary file read/write, code execution) with the MCP server, since the vulnerability itself has no built-in blast-radius limit — it's entirely a function of what was registered

Potential Attack Chains

1. Direct Network Reach — An attacker on the same network or with line-of-sight to an exposed port connects to /sse, lists registered tools with no authentication, and invokes any of them directly.
2. DNS Rebinding Against Local Instances — An attacker lures a victim to a malicious page; the page's script rebinds its origin's DNS to 127.0.0.1 and drives tool calls against the victim's local PraisonAI SSE server through the browser, bypassing the expectation that "localhost-only" traffic is safe.
3. Tool-Driven Compromise — Once tool invocation is possible, impact depends on what's registered: shell-execution tools yield arbitrary command execution, file tools enable read/write outside intended scope, and code-execution tools allow arbitrary Python/JS execution in the agent's runtime context.
4. Opportunistic Internet Scanning — PraisonAI has a recent, well-documented track record (see Background) of newly disclosed unauthenticated-access flaws being scanned and exploited within hours of public disclosure — this CVE should be treated with the same urgency.

Mitigation

Immediate Actions

• Upgrade praisonaiagents to 1.6.59 or later, which is the vendor-confirmed fix for this advisory.
• Audit every place ToolsMCPServer.run_sse or launch_tools_mcp_server is called and confirm the version in use is patched before assuming any existing SecurityConfig usage was actually enforced.
• If you cannot upgrade immediately, do not run the SSE transport bound to 0.0.0.0. Bind explicitly to 127.0.0.1 (or an internal-only interface) and put the server behind a reverse proxy or firewall rule that enforces authentication until the patched version is deployed.
• Inventory registered tools on any PraisonAI MCP deployment — shell, file, and code-execution tools represent the highest blast radius if this endpoint has been reachable.

Detection Opportunities

• Search perimeter and internal firewall/flow logs for inbound connections to /sse or /messages/ on hosts running PraisonAI, from unexpected source IPs.
• Review web/proxy access logs for GET /sse and POST /messages/ requests lacking an Authorization header, or originating from unexpected Origin/Referer values.
• On developer workstations, check for PraisonAI SSE servers listening on 0.0.0.0 rather than 127.0.0.1 using netstat/ss, especially on machines that also browse the open internet.
• Watch for the same opportunistic-scanner pattern seen in prior PraisonAI disclosures — automated probes of the exact vulnerable endpoint appearing within hours of this advisory's publication.

Defence-in-Depth

• Default every MCP server deployment to bind_localhost_only=True and require_auth=True, and treat 0.0.0.0 binding as an explicit, reviewed exception rather than a default.
• Terminate MCP SSE/HTTP traffic behind a reverse proxy that enforces its own authentication and Origin/Host allow-listing independent of the application layer, so a regression in the app doesn't remove all protection.
• Prefer PraisonAI's newer Streamable HTTP transport, which already enforces Origin validation, over the legacy SSE path where practical.
• Register the minimum set of tools an MCP server actually needs — avoid exposing shell or arbitrary code-execution tools on any server reachable outside a tightly controlled trust boundary.

Background

PraisonAI is a Python multi-agent orchestration framework used to build teams of cooperating AI agents, with built-in support for exposing custom tools to MCP clients like Claude Desktop and Cursor over stdio or SSE transports. CVE-2026-57123 is one of a larger batch of critical vulnerabilities disclosed across PraisonAI's MCP server and tooling layer around September 14, 2026 (a cluster spanning missing-authentication, SSRF, path-traversal, and code-injection issues), reflecting broader scrutiny of how the project's rapid feature growth has outpaced consistent enforcement of its own security controls.

This is not the project's first brush with an unauthenticated-by-default exposure. In May 2026, PraisonAI's legacy API server shipped with AUTH_ENABLED = False and AUTH_TOKEN = None hard-coded (CVE-2026-44338), and security researchers observed opportunistic scanners probing the exact vulnerable endpoint within roughly four hours of the advisory going public. That track record is a strong argument for treating CVE-2026-57123 as urgent rather than theoretical: any PraisonAI MCP SSE server left exposed after this disclosure should be assumed to be a target.

References

• NVD — CVE-2026-57123
• GitHub Security Advisory — GHSA-x227-pf99-vffg
• OSV.dev — GHSA-x227-pf99-vffg
• Strix.ai — CVE-2026-57123: praisonaiagents Missing Authentication
• PraisonAI repository
• cybersecuritynews.com — PraisonAI Vulnerability Exploited Within Hours of Public Disclosure (CVE-2026-44338 background)