CVE-2026-57139

PraisonAI is a multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp() in src/praisonai-ts/src/mcp/server.ts binds without a host restriction and forwards every HTTP POST request to handleRequest() without authentication or authorization. Any network client that can reach the port can call tools/list, tools/call, resources/read, or prompts/get, causing registered handlers to run with server-side credentials and process privileges or disclose registered data. An initial remediation was released in version 1.7.2.

PraisonAI is a multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp() in src/praisonai-ts/src/mcp/server.ts binds without a host restriction and forwards every HTTP POST request to handleRequest() without authentication or authorization. Any network client that can reach the port can call tools/list, tools/call, resources/read, or prompts/get, causing registered handlers to run with server-side credentials and process privileges or disclose registered data. An initial remediation was released in version 1.7.2.

Summary

The published npm package praisonai exports a TypeScript MCPServer that can expose tools, resources, and prompts over an HTTP JSON-RPC transport with:

await server.start({ port: 3000 });

The HTTP transport has no authentication or authorization path. MCPServerConfig does not expose an auth/security setting, startHttp() ignores the Authorization header, and every POST request is parsed and forwarded directly to handleRequest(). That request handler dispatches sensitive MCP methods such as tools/call, resources/read, and prompts/get.

The implementation also calls this.httpServer.listen(port) without a host argument. In Node.js this binds to the unspecified address; the local PoV observed { address: "::", family: "IPv6" }, making the service reachable on all interfaces on systems where the port is exposed.

This lets any network client that can reach the HTTP port list tools and invoke registered server-side tools without credentials. Supplying Authorization: Bearer invalid makes no difference.

Technical Details

MCPServerConfig exposes server metadata, tools/resources/prompts, stdio, port, and logging. It does not expose an auth token, authorization policy, MCPSecurity instance, authorization callback, or loopback-only option:

src/praisonai-ts/src/mcp/server.ts
  57: export interface MCPServerConfig {
  63:     tools?: MCPServerTool[];
  65:     resources?: MCPResource[];
  67:     prompts?: MCPPrompt[];
  69:     stdio?: boolean;
  73:     port?: number | null;
  75:     logging?: boolean;

handleRequest() dispatches sensitive MCP methods directly:

src/praisonai-ts/src/mcp/server.ts
  203: async handleRequest(request: MCPRequest): Promise<MCPResponse> {
  219:     case 'tools/call':
  220:       result = await this.handleToolCall(params);
  225:     case 'resources/read':
  226:       result = await this.handleResourceRead(params);
  231:     case 'prompts/get':
  232:       result = await this.handlePromptGet(params);

The tool dispatcher invokes the registered handler:

src/praisonai-ts/src/mcp/server.ts
  285: private async handleToolCall(params?: any): Promise<any> {
  288:   const tool = this.tools.get(name);
  298:   const result = await tool.handler(args ?? {});

The HTTP server parses every POST body and forwards it to handleRequest() with no authentication check:

src/praisonai-ts/src/mcp/server.ts
  403: async startHttp(port: number): Promise<void> {
  409:   this.httpServer = http.createServer(async (req, res) => {
  416:     const response = await this.handleRequest(request);
  434:   this.httpServer.listen(port, () => {

This is a guard-coverage gap because the same TypeScript package already ships a dedicated MCP security manager:

src/praisonai-ts/src/mcp/security.ts
  2:  * MCP Security - Authentication, authorization, and rate limiting
  79: export class MCPSecurity {
  132: async check(request: { path?: string; method?: string; headers?: ... })
  167: const auth = headers['authorization'] ?? headers['Authorization'];
  239: case 'authenticate':
  303: export function createApiKeyPolicy(...)

MCPServer never references that security manager in its HTTP request path.

Why This Is Not Intended Behavior

PraisonAI's MCP documentation says MCP servers allow AI models to use tools and communicate with external systems. The same page's security considerations say to use API keys in production, implement rate limiting, validate incoming requests, use HTTPS, and limit custom tool permissions.

PraisonAI's security page also documents prior breaking hardening where API servers were changed to require authentication by default and bind to 127.0.0.1 instead of 0.0.0.0. It separately lists MCP tools/call issues as security vulnerabilities.

The npm TypeScript MCPServer does the opposite:

• start({ port }) binds to the unspecified address;
• MCPServerConfig has no auth/security…

PraisonAI is a multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp() in src/praisonai-ts/src/mcp/server.ts binds without a host restriction and forwards every HTTP POST request to handleRequest() without authentication or authorization. Any network client that can reach the port can call tools/list, tools/call, resources/read, or prompts/get, causing registered handlers to run with server-side credentials and process privileges or disclose registered data. An initial remediation was released in version 1.7.2.

PraisonAI is a multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp() in src/praisonai-ts/src/mcp/server.ts binds without a host restriction and forwards every HTTP POST request to handleRequest() without authentication or authorization. Any network client that can reach the port can call tools/list, tools/call, resources/read, or prompts/get, causing registered handlers to run with server-side credentials and process privileges or disclose registered data. An initial remediation was released in version 1.7.2.

Summary

The published npm package praisonai exports a TypeScript MCPServer that can expose tools, resources, and prompts over an HTTP JSON-RPC transport with:

await server.start({ port: 3000 });

The HTTP transport has no authentication or authorization path. MCPServerConfig does not expose an auth/security setting, startHttp() ignores the Authorization header, and every POST request is parsed and forwarded directly to handleRequest(). That request handler dispatches sensitive MCP methods such as tools/call, resources/read, and prompts/get.

The implementation also calls this.httpServer.listen(port) without a host argument. In Node.js this binds to the unspecified address; the local PoV observed { address: "::", family: "IPv6" }, making the service reachable on all interfaces on systems where the port is exposed.

This lets any network client that can reach the HTTP port list tools and invoke registered server-side tools without credentials. Supplying Authorization: Bearer invalid makes no difference.

Technical Details

MCPServerConfig exposes server metadata, tools/resources/prompts, stdio, port, and logging. It does not expose an auth token, authorization policy, MCPSecurity instance, authorization callback, or loopback-only option:

src/praisonai-ts/src/mcp/server.ts
  57: export interface MCPServerConfig {
  63:     tools?: MCPServerTool[];
  65:     resources?: MCPResource[];
  67:     prompts?: MCPPrompt[];
  69:     stdio?: boolean;
  73:     port?: number | null;
  75:     logging?: boolean;

handleRequest() dispatches sensitive MCP methods directly:

src/praisonai-ts/src/mcp/server.ts
  203: async handleRequest(request: MCPRequest): Promise<MCPResponse> {
  219:     case 'tools/call':
  220:       result = await this.handleToolCall(params);
  225:     case 'resources/read':
  226:       result = await this.handleResourceRead(params);
  231:     case 'prompts/get':
  232:       result = await this.handlePromptGet(params);

The tool dispatcher invokes the registered handler:

src/praisonai-ts/src/mcp/server.ts
  285: private async handleToolCall(params?: any): Promise<any> {
  288:   const tool = this.tools.get(name);
  298:   const result = await tool.handler(args ?? {});

The HTTP server parses every POST body and forwards it to handleRequest() with no authentication check:

src/praisonai-ts/src/mcp/server.ts
  403: async startHttp(port: number): Promise<void> {
  409:   this.httpServer = http.createServer(async (req, res) => {
  416:     const response = await this.handleRequest(request);
  434:   this.httpServer.listen(port, () => {

This is a guard-coverage gap because the same TypeScript package already ships a dedicated MCP security manager:

src/praisonai-ts/src/mcp/security.ts
  2:  * MCP Security - Authentication, authorization, and rate limiting
  79: export class MCPSecurity {
  132: async check(request: { path?: string; method?: string; headers?: ... })
  167: const auth = headers['authorization'] ?? headers['Authorization'];
  239: case 'authenticate':
  303: export function createApiKeyPolicy(...)

MCPServer never references that security manager in its HTTP request path.

Why This Is Not Intended Behavior

PraisonAI's MCP documentation says MCP servers allow AI models to use tools and communicate with external systems. The same page's security considerations say to use API keys in production, implement rate limiting, validate incoming requests, use HTTPS, and limit custom tool permissions.

PraisonAI's security page also documents prior breaking hardening where API servers were changed to require authentication by default and bind to 127.0.0.1 instead of 0.0.0.0. It separately lists MCP tools/call issues as security vulnerabilities.

The npm TypeScript MCPServer does the opposite:

• start({ port }) binds to the unspecified address;
• MCPServerConfig has no auth/security…