What is the CVSS score of CVE-2026-34953?

CVE-2026-34953 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Python are affected by CVE-2026-34953?

PraisonAI MCP server (praisonai Python package) contains a critical authentication bypass vulnerability that allows unauthenticated remote attackers to execute arbitrary agents, workflows, and file…. A patch is available.

How to fix or mitigate CVE-2026-34953?

Within 24 hours: Immediately inventory all systems running praisonai package and isolate affected instances from production environments or public networks. Within 7 days: Contact PraisonAI project maintainers for patch timeline; implement temporary mitigation by deploying network-level access controls (firewall rules, reverse proxy authentication) to restrict MCP server access to trusted networks only. Within 30 days: Apply vendor-released patch immediately upon availability; do not delay-no safe version timeline currently exists. Perform full audit of agent/workflow execution logs for unauthorized access attempts.

Python CVE-2026-34953

CRITICAL

Incorrect Authorization (CWE-863)

2026-04-01 https://github.com/MervinPraison/PraisonAI

GHSA-98f9-fqg5-hvq5

Authentication Bypass Python

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Apr 02, 2026 - 14:30 nvd

Patch available

Analysis Generated

Apr 02, 2026 - 00:15 vuln.today

CVE Published

Apr 01, 2026 - 23:29 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

Summary

OAuthManager.validate_token() returns True for any token not found in its internal store, which is empty by default. Any HTTP request to the MCP server with an arbitrary Bearer token is treated as authenticated, granting full access to all registered tools and agent capabilities.

Details

oauth.py:364 (source) -> oauth.py:374 (loop miss) -> oauth.py:381 (sink)

python

# source
def validate_token(self, token: str) -> bool:
    for stored_token in self._tokens.values():
        if stored_token.access_token == token:
            return not stored_token.is_expired()
# sink -- _tokens is empty by default, loop never executes, falls through
    return True

PoC

bash

# install: pip install -e src/praisonai
# start server: praisonai mcp serve --transport http-stream --port 8080

curl -s -X POST http://127.0.0.1:8080/mcp \
  -H "Authorization: Bearer fake_token_abc123" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"tools/list","id":1}'
# expected output: 200 OK with full tool list (50+ tools)
# including praisonai.agent.run, praisonai.workflow.run, praisonai.containers.file_write

Impact

Any unauthenticated attacker with network access to the MCP HTTP server can call all registered tools including agent execution, workflow runs, container file read/write, and skill loading. The server binds to 0.0.0.0 by default with no API key required.

Suggested Fix

python

def validate_token(self, token: str) -> bool:
    for stored_token in self._tokens.values():
        if stored_token.access_token == token:
            return not stored_token.is_expired()
# Unknown tokens must be rejected.
# For external/JWT tokens, call the introspection endpoint here before returning.
    return False

AnalysisAI

Authentication bypass in PraisonAI MCP server (Python package praisonai) allows remote, unauthenticated attackers to execute arbitrary agents, workflows, and file operations with zero authentication. The OAuthManager.validate_token() method incorrectly returns True for any token when its internal token store is empty (default state), treating all HTTP requests with arbitrary Bearer tokens as authenticated. This grants full access to 50+ registered tools including praisonai.agent.run, praisonai.w

Technical ContextAI

This vulnerability stems from a logic error in the OAuth token validation routine within the PraisonAI MCP (Model Context Protocol) server component. The affected code in oauth.py implements a validate_token() method that iterates over an internal _tokens dictionary to verify Bearer tokens. However, when this dictionary is empty-which is the default state unless explicitly populated-the for-loop never executes, causing the function to fall through to an unconditional 'return True' statement at line 381. This is a classic example of CWE-863 (Incorrect Authorization), where the authorization logic fails open rather than closed. The MCP server exposes a JSON-RPC 2.0 API over HTTP that provides access to AI agent execution primitives, workflow orchestration, and container filesystem operations. The vulnerability affects the Python pip package 'praisonai' and occurs specifically in the HTTP-stream transport mode when the server is started with 'praisonai mcp serve --transport http-stream'. The default binding to 0.0.0.0 exposes this vulnerability to any network-accessible client.

RemediationAI

Apply the vendor-released patch by upgrading to the fixed version of the praisonai Python package as specified in the GitHub Security Advisory at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-98f9-fqg5-hvq5 and https://github.com/advisories/GHSA-98f9-fqg5-hvq5. The fix changes the OAuthManager.validate_token() method to return False (reject) for unknown tokens instead of True (accept). If immediate patching is not feasible, implement network-level access controls to restrict MCP server exposure: bind the server to localhost (127.0.0.1) instead of 0.0.0.0, deploy behind a reverse proxy with mandatory authentication, or implement firewall rules allowing only trusted source IPs. For production deployments, explicitly populate the OAuth token store with valid credentials before starting the server, although this is a workaround rather than a fix since the underlying logic flaw remains. Review application logs for suspicious tool invocations (praisonai.agent.run, workflow.run, file_write) from unexpected sources during the vulnerability window. Do not expose PraisonAI MCP servers directly to the internet until patched.