PraisonAI CVE-2026-57139

Requires the operator to start the PraisonAI TypeScript MCP server over the HTTP JSON-RPC transport (e.g. server.start({ port: 3000 }) / MCPServerConfig.port set) - stdio-only deployments are not exposed. When HTTP is enabled, startHttp() calls httpServer.listen(port) with no host argument, so Node binds the unspecified address (all interfaces) and any network client reaching the port can call tools/call, resources/read, or prompts/get with no credentials; MCPServerConfig exposes no auth token, authorization policy, or loopback-only option. Impact severity scales with what tools/resources/prompts the operator registered and the privileges of the server process. Limiting factors: the port must be network-reachable (exposed beyond localhost/firewall) and the HTTP transport must be in use; there is no user interaction or authentication barrier once reachable. Affected npm praisonai >=1.5.0 through <=1.7.1; initial remediation in 1.7.2.

This is a genuinely high-priority issue with a well-calibrated CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). All signals align: the MCP HTTP transport in the npm praisonai package (src/praisonai-ts/src/mcp/server.ts) binds to the unspecified address (observed '::', all interfaces) and forwards every POST straight to handleRequest() with no authentication or authorization path - CWE-306, missing authentication for a critical function. Any client that can reach the port can invoke tools/call, resources/read, or prompts/get, causing registered handlers to execute with server-side credentials and process privileges (integrity/availability impact) or disclose registered data (confidentiality impact), so C:H/I:H/A:H is defensible rather than inflated. Supporting signals: POC/exploit code is publicly available (a working gist), a vendor patch exists (npm 1.7.2), and the GHSA advisory confirms the root cause with line-level source evidence. The only tempering signals are that this is NOT in CISA KEV (no confirmed active exploitation) and EPSS is modest at 0.64% (49th percentile), consistent with a niche framework where mass automated exploitation has not materialized despite public PoV. The real limiter is deployment posture: the flaw only bites when an operator actually starts the HTTP transport (server.start({port})) and the port is reachable - but when they do, exploitation is trivial and unauthenticated. Net: treat as urgent for anyone running the PraisonAI TypeScript MCP server over HTTP; lower urgency for stdio-only or non-exposed deployments.

An operator runs the PraisonAI TypeScript MCP server with the HTTP transport (server.start({ port: 3000 })), which binds to all interfaces with no auth. An attacker who can reach that port sends a JSON-RPC POST for tools/list to enumerate registered tools, then tools/call to invoke a handler that runs with the server's credentials and process privileges - sending 'Authorization: Bearer invalid' changes nothing. Publicly available PoC/exploit code exists (a gist), lowering the bar to immediate opportunistic abuse against exposed instances.