CVE-2026-61427

PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the CLI --api-key option defaults to None, and the server only enforces Authorization/Bearer checks when an API key is configured. When an operator runs 'praisonai mcp serve --transport http-stream' without an API key, an unauthenticated client (no Authorization header, and no Origin header, which is also permitted) can initialize a session, enumerate the available tools (tools/list), and invoke tools (tools/call). Additionally, the dispatcher forwards tool-call arguments to handlers without validating them against the advertised inputSchema. The server binds to 127.0.0.1 by default, so remote exploitation requires the operator to bind to a network-accessible address (e.g., --host 0.0.0.0).

PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the CLI --api-key option defaults to None, and the server only enforces Authorization/Bearer checks when an API key is configured. When an operator runs 'praisonai mcp serve --transport http-stream' without an API key, an unauthenticated client (no Authorization header, and no Origin header, which is also permitted) can initialize a session, enumerate the available tools (tools/list), and invoke tools (tools/call). Additionally, the dispatcher forwards tool-call arguments to handlers without validating them against the advertised inputSchema. The server binds to 127.0.0.1 by default, so remote exploitation requires the operator to bind to a network-accessible address (e.g., --host 0.0.0.0).

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-hc5v-gxvj-58wh. This link is maintained to preserve external references.

Original Description

PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the CLI --api-key option defaults to None, and the server only enforces Authorization/Bearer checks when an API key is configured. When an operator runs 'praisonai mcp serve --transport http-stream' without an API key, an unauthenticated client (no Authorization header, and no Origin header, which is also permitted) can initialize a session, enumerate the available tools (tools/list), and invoke tools (tools/call). Additionally, the dispatcher forwards tool-call arguments to handlers without validating them against the advertised inputSchema. The server binds to 127.0.0.1 by default, so remote exploitation requires the operator to bind to a network-accessible address (e.g., --host 0.0.0.0).

Summary

PraisonAI's MCP HTTP-stream server authenticates requests only when an API key is configured; the CLI defaults --api-key to None, so praisonai mcp serve --transport http-stream exposes the full MCP surface unauthenticated. A request with no Authorization (and no Origin) can initialize and tools/list (~50 tools), and the dispatcher forwards tool-call arguments to handlers without validating them against the advertised inputSchema. Runtime-confirmed for unauthenticated initialize/tools/list and the dispatcher schema-bypass. This is not an RCE/file-read in 4.6.63 — workflow.run/workflow.run_file are runtime-refuted (adapter regression). Severity Medium–High.

Details

Affected component

• Package: praisonai 4.6.63. Files: src/praisonai/praisonai/mcp_server/transports/http_stream.py, mcp_server/cli.py, mcp_server/server.py (dispatcher).

Vulnerable code / root cause

Path: src/praisonai/praisonai/mcp_server/transports/http_stream.py

Function: mcp_post / _validate_origin

Snippet:

if self.api_key:                       # auth applied ONLY when api_key is set
    auth_header = request.headers.get("Authorization", "")
    if not auth_header.startswith("Bearer ") or auth_header[7:] != self.api_key:
        return JSONResponse({"error": "Unauthorized"}, status_code=401)
# _validate_origin: returns True when the Origin header is absent

Issue: with api_key=None, no auth check runs; a missing Origin header is allowed, so non-browser clients (curl/Burp) are not blocked.

Path: src/praisonai/praisonai/mcp_server/cli.py

Function: cmd_serve (argparse)

Snippet:

parser.add_argument("--api-key", default=None)   # unauthenticated by default

Path: src/praisonai/praisonai/mcp_server/server.py

Function: _handle_tools_call

Snippet:

result = await tool.handler(**arguments)   # arguments forwarded without inputSchema validation

Issue: attacker-controlled arguments are passed straight to the handler; the dispatcher does not validate them against the tool's advertised inputSchema. The only thing rejecting undeclared keys is the handler's own Python signature.

Attack flow

1. Operator runs praisonai mcp serve --transport http-stream (no --api-key).
2. Attacker (no auth, no Origin) sends initialize → session; tools/list → enumerates ~50 tools; tools/call → arguments pass through unvalidated.

Why existing protection is bypassed

Auth is opt-in (only added when an api key is set); missing Origin is allowed; the dispatcher does not enforce inputSchema.

Security boundary

Unauthenticated access to the MCP tool surface. Default bind 127.0.0.1 (any local process / multi-user host; remote only if --host 0.0.0.0).

Scope limits (do not overclaim)

• praisonai.workflow.run / workflow.run_file are runtime-refuted in 4.6.63: the adapter calls AgentsGenerator(...) missing the required config_list argument → errors before any execution/file open. Several other tool adapters also error at runtime. No unauthenticated RCE/arbitrary-file-open via these tools at HEAD.
• MCP knowledge.add file read is broken (see FT-01_Knowledge_FileRead_Negative_Report.md).

Proof of Concept

Environment

Real MCP HTTP-stream server (api_key=None) in a local runtime (127.0.0.1:18090). Runnable assets: PraisonAI-Runtime-Repro\runtime-files\ (docker-compose.mcp.yml). MCP requests use Accept: application/json + header Mcp-Session-Id.

Steps to reproduce

1. MCP-Initialize: POST /mcp initialize (no Authorization) → 200 + mcp-session-id.
2. MCP-Tools-List-NoAuth: POST /mcp tools/list with that session id → 200 + ~50 tools.
3. MCP-Schema-Bypass: tools/call with an undeclared extra argument (__undeclared_evil_param__).

Expected result

The transport requires authentication; the dispatcher validates arguments against inputSchema.

Actual result

-…

PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the CLI --api-key option defaults to None, and the server only enforces Authorization/Bearer checks when an API key is configured. When an operator runs 'praisonai mcp serve --transport http-stream' without an API key, an unauthenticated client (no Authorization header, and no Origin header, which is also permitted) can initialize a session, enumerate the available tools (tools/list), and invoke tools (tools/call). Additionally, the dispatcher forwards tool-call arguments to handlers without validating them against the advertised inputSchema. The server binds to 127.0.0.1 by default, so remote exploitation requires the operator to bind to a network-accessible address (e.g., --host 0.0.0.0).

PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the CLI --api-key option defaults to None, and the server only enforces Authorization/Bearer checks when an API key is configured. When an operator runs 'praisonai mcp serve --transport http-stream' without an API key, an unauthenticated client (no Authorization header, and no Origin header, which is also permitted) can initialize a session, enumerate the available tools (tools/list), and invoke tools (tools/call). Additionally, the dispatcher forwards tool-call arguments to handlers without validating them against the advertised inputSchema. The server binds to 127.0.0.1 by default, so remote exploitation requires the operator to bind to a network-accessible address (e.g., --host 0.0.0.0).

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-hc5v-gxvj-58wh. This link is maintained to preserve external references.

Original Description

PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the CLI --api-key option defaults to None, and the server only enforces Authorization/Bearer checks when an API key is configured. When an operator runs 'praisonai mcp serve --transport http-stream' without an API key, an unauthenticated client (no Authorization header, and no Origin header, which is also permitted) can initialize a session, enumerate the available tools (tools/list), and invoke tools (tools/call). Additionally, the dispatcher forwards tool-call arguments to handlers without validating them against the advertised inputSchema. The server binds to 127.0.0.1 by default, so remote exploitation requires the operator to bind to a network-accessible address (e.g., --host 0.0.0.0).

Summary

PraisonAI's MCP HTTP-stream server authenticates requests only when an API key is configured; the CLI defaults --api-key to None, so praisonai mcp serve --transport http-stream exposes the full MCP surface unauthenticated. A request with no Authorization (and no Origin) can initialize and tools/list (~50 tools), and the dispatcher forwards tool-call arguments to handlers without validating them against the advertised inputSchema. Runtime-confirmed for unauthenticated initialize/tools/list and the dispatcher schema-bypass. This is not an RCE/file-read in 4.6.63 — workflow.run/workflow.run_file are runtime-refuted (adapter regression). Severity Medium–High.

Details

Affected component

• Package: praisonai 4.6.63. Files: src/praisonai/praisonai/mcp_server/transports/http_stream.py, mcp_server/cli.py, mcp_server/server.py (dispatcher).

Vulnerable code / root cause

Path: src/praisonai/praisonai/mcp_server/transports/http_stream.py

Function: mcp_post / _validate_origin

Snippet:

if self.api_key:                       # auth applied ONLY when api_key is set
    auth_header = request.headers.get("Authorization", "")
    if not auth_header.startswith("Bearer ") or auth_header[7:] != self.api_key:
        return JSONResponse({"error": "Unauthorized"}, status_code=401)
# _validate_origin: returns True when the Origin header is absent

Issue: with api_key=None, no auth check runs; a missing Origin header is allowed, so non-browser clients (curl/Burp) are not blocked.

Path: src/praisonai/praisonai/mcp_server/cli.py

Function: cmd_serve (argparse)

Snippet:

parser.add_argument("--api-key", default=None)   # unauthenticated by default

Path: src/praisonai/praisonai/mcp_server/server.py

Function: _handle_tools_call

Snippet:

result = await tool.handler(**arguments)   # arguments forwarded without inputSchema validation

Issue: attacker-controlled arguments are passed straight to the handler; the dispatcher does not validate them against the tool's advertised inputSchema. The only thing rejecting undeclared keys is the handler's own Python signature.

Attack flow

1. Operator runs praisonai mcp serve --transport http-stream (no --api-key).
2. Attacker (no auth, no Origin) sends initialize → session; tools/list → enumerates ~50 tools; tools/call → arguments pass through unvalidated.

Why existing protection is bypassed

Auth is opt-in (only added when an api key is set); missing Origin is allowed; the dispatcher does not enforce inputSchema.

Security boundary

Unauthenticated access to the MCP tool surface. Default bind 127.0.0.1 (any local process / multi-user host; remote only if --host 0.0.0.0).

Scope limits (do not overclaim)

• praisonai.workflow.run / workflow.run_file are runtime-refuted in 4.6.63: the adapter calls AgentsGenerator(...) missing the required config_list argument → errors before any execution/file open. Several other tool adapters also error at runtime. No unauthenticated RCE/arbitrary-file-open via these tools at HEAD.
• MCP knowledge.add file read is broken (see FT-01_Knowledge_FileRead_Negative_Report.md).

Proof of Concept

Environment

Real MCP HTTP-stream server (api_key=None) in a local runtime (127.0.0.1:18090). Runnable assets: PraisonAI-Runtime-Repro\runtime-files\ (docker-compose.mcp.yml). MCP requests use Accept: application/json + header Mcp-Session-Id.

Steps to reproduce

1. MCP-Initialize: POST /mcp initialize (no Authorization) → 200 + mcp-session-id.
2. MCP-Tools-List-NoAuth: POST /mcp tools/list with that session id → 200 + ~50 tools.
3. MCP-Schema-Bypass: tools/call with an undeclared extra argument (__undeclared_evil_param__).

Expected result

The transport requires authentication; the dispatcher validates arguments against inputSchema.

Actual result

-…

Summary

PraisonAI's MCP HTTP-stream server authenticates requests only when an API key is configured; the CLI defaults --api-key to None, so praisonai mcp serve --transport http-stream exposes the full MCP surface unauthenticated. A request with no Authorization (and no Origin) can initialize and tools/list (~50 tools), and the dispatcher forwards tool-call arguments to handlers without validating them against the advertised inputSchema. Runtime-confirmed for unauthenticated initialize/tools/list and the dispatcher schema-bypass. This is not an RCE/file-read in 4.6.63 — workflow.run/workflow.run_file are runtime-refuted (adapter regression). Severity Medium–High.

Details

Affected component

• Package: praisonai 4.6.63. Files: src/praisonai/praisonai/mcp_server/transports/http_stream.py, mcp_server/cli.py, mcp_server/server.py (dispatcher).

Vulnerable code / root cause

Path: src/praisonai/praisonai/mcp_server/transports/http_stream.py

Function: mcp_post / _validate_origin

Snippet:

if self.api_key:                       # auth applied ONLY when api_key is set
    auth_header = request.headers.get("Authorization", "")
    if not auth_header.startswith("Bearer ") or auth_header[7:] != self.api_key:
        return JSONResponse({"error": "Unauthorized"}, status_code=401)
# _validate_origin: returns True when the Origin header is absent

Issue: with api_key=None, no auth check runs; a missing Origin header is allowed, so non-browser clients (curl/Burp) are not blocked.

Path: src/praisonai/praisonai/mcp_server/cli.py

Function: cmd_serve (argparse)

Snippet:

parser.add_argument("--api-key", default=None)   # unauthenticated by default

Path: src/praisonai/praisonai/mcp_server/server.py

Function: _handle_tools_call

Snippet:

result = await tool.handler(**arguments)   # arguments forwarded without inputSchema validation

Issue: attacker-controlled arguments are passed straight to the handler; the dispatcher does not validate them against the tool's advertised inputSchema. The only thing rejecting undeclared keys is the handler's own Python signature.

Attack flow

1. Operator runs praisonai mcp serve --transport http-stream (no --api-key).
2. Attacker (no auth, no Origin) sends initialize → session; tools/list → enumerates ~50 tools; tools/call → arguments pass through unvalidated.

Why existing protection is bypassed

Auth is opt-in (only added when an api key is set); missing Origin is allowed; the dispatcher does not enforce inputSchema.

Security boundary

Unauthenticated access to the MCP tool surface. Default bind 127.0.0.1 (any local process / multi-user host; remote only if --host 0.0.0.0).

Scope limits (do not overclaim)

• praisonai.workflow.run / workflow.run_file are runtime-refuted in 4.6.63: the adapter calls AgentsGenerator(...) missing the required config_list argument → errors before any execution/file open. Several other tool adapters also error at runtime. No unauthenticated RCE/arbitrary-file-open via these tools at HEAD.
• MCP knowledge.add file read is broken (see FT-01_Knowledge_FileRead_Negative_Report.md).

Proof of Concept

Environment

Real MCP HTTP-stream server (api_key=None) in a local runtime (127.0.0.1:18090). Runnable assets: PraisonAI-Runtime-Repro\runtime-files\ (docker-compose.mcp.yml). MCP requests use Accept: application/json + header Mcp-Session-Id.

Steps to reproduce

1. MCP-Initialize: POST /mcp initialize (no Authorization) → 200 + mcp-session-id.
2. MCP-Tools-List-NoAuth: POST /mcp tools/list with that session id → 200 + ~50 tools.
3. MCP-Schema-Bypass: tools/call with an undeclared extra argument (__undeclared_evil_param__).

Expected result

The transport requires authentication; the dispatcher validates arguments against inputSchema.

Actual result

-…