PraisonAI Agents CVE-2026-57123

Requires that an operator explicitly start the MCP SSE transport via ToolsMCPServer.run_sse() or launch_tools_mcp_server(transport='sse') in praisonaiagents < 1.6.59; both default host to 0.0.0.0, and the Starlette app is built with only debug and routes (no middleware= auth/origin gate), so exposure is the default once launched. Direct unauthenticated network exploitation requires only reachability to the listening port (default 8080) - no credentials, no user interaction. The DNS-rebinding variant additionally requires a victim to visit an attacker-controlled web page (user interaction) to reach a localhost-bound instance. The severity of impact is limited/amplified by which tools are registered: full RCE only applies when file, shell, or code-execution tools are registered; a benign tool set constrains impact to those tools' capabilities. Not triggered by merely importing the library - the SSE server must be running.

This is a genuine missing-authentication flaw (CWE-306) rather than an inflated high-CVSS score, but its real-world priority is moderated by strong deployment gates. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) is defensible for the worst case: once ToolsMCPServer.run_sse or launch_tools_mcp_server(transport='sse') is started, it binds 0.0.0.0 by default and exposes /sse and /messages/ with no auth middleware and no Origin check, so any network-reachable client can list and invoke every registered tool with no credentials. The SecurityConfig/origin/DNS-rebinding controls exist in mcp_security.py but are dead code - confirmed by both the GHSA advisory and the fix commit that finally wires build_sse_security_app into run_sse. However, the signals diverge on urgency: EPSS is only 0.47% (40th percentile) and SSVC lists Exploitation as 'none' (no observed exploitation), even though Automatable=yes and Technical Impact=total. There is no CISA KEV listing and no weaponized exploit - only a static AST proof-of-concept in the advisory. Critically, impact is conditional: the advisory itself states blast radius 'equals the capabilities of the registered tools' - RCE only when file/shell/code-exec tools are registered. Exploitation also requires that an operator explicitly launch the SSE transport (not automatic on import). Net: a real, easily-automatable weakness worth prompt patching for anyone running the MCP SSE server, but the absence of active exploitation, low EPSS, and dependence on operator configuration place it below internet-facing mass-exploitation threats.

A developer runs launch_tools_mcp_server(transport='sse') to expose PraisonAI tools (including file/shell/code-execution tools) over MCP; because it binds 0.0.0.0 with no authentication, any host on the network sends JSON-RPC calls to /messages/ to enumerate and invoke those tools, achieving code execution. Alternatively, a victim developer merely visits a malicious web page that uses DNS rebinding to point its hostname at 127.0.0.1 and drives the same tool calls against the local instance cross-origin. No public weaponized exploit exists - only a static AST-based proof in the GHSA advisory.