PraisonAI EUVD-2026-65498

The MCP HTTP Stream server component must be running and network-reachable. In the default configuration no API key is set, so the server accepts initialize requests from any caller without authentication. The Origin header check is the only access gate, but the GHSA advisory confirms that requests with no Origin header are accepted unconditionally, and a separate startswith bypass exists for malformed Origin values. Exploitation requires only the ability to send HTTP POST requests to the MCP endpoint. What limits exploitation: the vulnerability is only present when the MCP HTTP Stream transport is actively deployed, not in base PraisonAI installations that do not use this component; configuring auth_token introduces required Bearer token validation and is an effective compensating control; binding the MCP server to localhost or a private interface restricts the attacker surface to co-located or local-network parties.

The NVD-provided CVSS 3.1 vector scores 6.5 (Medium) with UI:R, suggesting the original scorer weighted the browser-based CSRF-like attack path that exploits a companion Origin-header startswith validation bypass requiring a victim to visit a malicious page. However, the GHSA advisory explicitly states that HTTP requests carrying no Origin header are accepted by the server, establishing a direct unauthenticated attack path with no user interaction required - correctly characterized as UI:N, which yields 7.5 (High). No EPSS data was provided in the input and the CVE is absent from CISA KEV, so active exploitation is unconfirmed. The attack is trivially automatable in default configurations because no API key is required unless explicitly set, and the only guard (Origin validation) is bypassable or entirely absent for direct HTTP clients. The blast radius is limited to availability - there is no known confidentiality or integrity impact - but a single attacker can crash an exposed PraisonAI MCP service without any credentials, making this a real operational priority for internet-facing deployments.

An attacker with network access to the exposed PraisonAI MCP HTTP Stream port sends a high-volume loop of HTTP POST initialize requests using any standard HTTP client or scripting tool. Because no API key is configured by default and no Origin header is required for direct requests, each request is accepted and a new dictionary is inserted into self._sessions with no eviction. After sufficient volume, the Python process heap is exhausted and the operating system OOM killer terminates it, taking down the multi-agent service. No public proof-of-concept has been identified at time of analysis.