EUVD-2026-44638
GHSA-5866-9272-qcfv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects that two non-default operator choices (no API key and public bind) must co-occur; impacts are Low across C/I/A given tool-scope dependency.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the CLI --api-key option defaults to None, and the server only enforces Authorization/Bearer checks when an API key is configured. When an operator runs 'praisonai mcp serve --transport http-stream' without an API key, an unauthenticated client (no Authorization header, and no Origin header, which is also permitted) can initialize a session, enumerate the available tools (tools/list), and invoke tools (tools/call). Additionally, the dispatcher forwards tool-call arguments to handlers without validating them against the advertised inputSchema. The server binds to 127.0.0.1 by default, so remote exploitation requires the operator to bind to a network-accessible address (e.g., --host 0.0.0.0).
AnalysisAI
PraisonAI's MCP HTTP-stream transport silently skips authentication when no API key is configured at startup, allowing unauthenticated clients to initialize sessions, enumerate tools via tools/list, and invoke arbitrary tools via tools/call. Affected versions are all releases before 4.6.78. Compounding this, the dispatcher passes tool-call arguments directly to handlers without validating them against the advertised inputSchema, meaning a client can supply malformed or out-of-schema arguments to any registered tool. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Technical ContextAI
PraisonAI (CPE: cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:*) is a Python-based multi-agent AI framework that implements the Model Context Protocol (MCP) over an HTTP-stream transport. When the operator launches 'praisonai mcp serve --transport http-stream', the server initialises an MCP session handler that is supposed to enforce Bearer token authentication via an Authorization header. However, the --api-key CLI option defaults to None, and the conditional auth check is only registered when a non-None key is supplied - making the entire authentication path dead code in the default configuration. CWE-20 (Improper Input Validation) is the root cause for the second weakness: tool-call arguments are forwarded to registered handlers without being validated against the JSON Schema advertised in tools/list, enabling schema-violating payloads to reach handler logic directly. The server defaults to binding on 127.0.0.1, so the MCP transport is not inherently network-reachable in the default deployment.
RemediationAI
Upgrade PraisonAI to version 4.6.78 or later, which is the vendor-released patch per the advisory at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-hc5v-gxvj-58wh. For deployments that cannot immediately upgrade, always pass a strong --api-key value when starting the MCP server (e.g., 'praisonai mcp serve --transport http-stream --api-key <strong-random-token>'), which re-enables the Bearer token enforcement path; note that this mitigation requires all legitimate clients to be updated with the corresponding Authorization header. As an additional layer, do not override the default --host 127.0.0.1 binding unless strictly necessary; if a public bind is required, place a reverse proxy (nginx, Caddy) or network firewall rule in front of the MCP endpoint that enforces authentication at the network boundary. The input validation bypass for tool arguments should also be remediated by upgrading, as the patch is expected to address both weaknesses per the advisory scope.
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an att
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can inf
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to ex
Remote unauthenticated access to PraisonAI's legacy Flask API server allows attackers to execute configured agent workfl
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the appl
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today