CVE-2026-55532

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream _validate_origin uses request_origin.startswith(allowed), allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests without preflight and invoke tools/call without an API key, including file writes that persist agent instructions. This issue is fixed in version 4.6.58.

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream _validate_origin uses request_origin.startswith(allowed), allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests without preflight and invoke tools/call without an API key, including file writes that persist agent instructions. This issue is fixed in version 4.6.58.

Summary

The PraisonAI MCP server exposes an HTTP-stream transport (praisonai mcp serve --transport http-stream) that binds to localhost and, by default, has no API key. Its only access control for browser-originated requests is an Origin allowlist, which the code implements as required by the MCP 2025-11-25 security guidance. The allowlist check uses a prefix match (request_origin.startswith(allowed)), so any Origin whose string begins with http://localhost or http://127.0.0.1 is accepted, for example http://localhost.attacker.com. An attacker who registers such a hostname and serves a page from it can, when a victim visits the page, issue cross-site requests that the MCP server accepts and executes without authentication. Because the request can be sent as a CORS "simple request" (Content-Type: text/plain, which the server still parses as JSON), it requires no preflight, and because tools/call does not require a session, a single forged request executes an MCP tool. This is a blind cross-site request forgery against a developer's local agent runtime. A natural end-to-end impact is persistent prompt injection: the forged request creates a rule file that the agent runtime loads with activation "always", so attacker-controlled instructions are injected into every subsequent agent run on the victim's machine.

Details

The HTTP-stream transport validates the Origin header in transports/http_stream.py. The allowlist is built for a localhost bind, then matched with startswith:

# __init__: default allowlist when binding to localhost
self.allowed_origins = ["http://localhost", "http://127.0.0.1",
                        "https://localhost", "https://127.0.0.1"]

def _validate_origin(self, request_origin):
    if request_origin is None:
        return True                      # no Origin -> allowed
    if self.allowed_origins is None:
        return False
    for allowed in self.allowed_origins:
        if request_origin == allowed or request_origin.startswith(allowed):
            return True                  # prefix match: the bypass
    return False

"http://localhost.attacker.com".startswith("http://localhost") is True, so the request is accepted. The attacker only needs to host the malicious page on a domain whose name begins with localhost or 127.0.0.1 (a subdomain label such as localhost.attacker.com), which makes the browser send Origin: http://localhost.attacker.com.

Three further properties make this directly reachable from a web page:

1. No authentication by default. In cli.py cmd_serve, --api-key defaults to None, and in mcp_post the auth check is skipped entirely when no key is configured:

if self.api_key:                          # None by default -> block skipped
    auth_header = request.headers.get("Authorization", "")
    ...

2. No preflight required. The body is parsed with await request.json(), which reads the raw body regardless of Content-Type. A page can therefore send the JSON-RPC payload as a CORS "simple request" with Content-Type: text/plain and no custom headers, which the browser delivers without an OPTIONS preflight. The response is not readable cross-origin, but the side effect has already occurred (blind CSRF).

3. No session required for tools/call. The session check only rejects when a session id is present but unknown:

session_id = request.headers.get("MCP-Session-Id") or request.headers.get("Mcp-Session-Id")
if session_id and session_id not in self._sessions:
    return JSONResponse({"error": "Session not found"}, status_code=404)

With no session header, session_id is None and the request proceeds straight to the dispatcher, which calls the tool handler with no authorization (server.py _handle_tools_call: result = tool.handler(**arguments)).

End-to-end impact via the rules tool. The unauthenticated praisonai.rules.create tool writes a file into the global rules directory (mcp_server/adapters/cli_tools.py confines the name to…

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream _validate_origin uses request_origin.startswith(allowed), allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests without preflight and invoke tools/call without an API key, including file writes that persist agent instructions. This issue is fixed in version 4.6.58.

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream _validate_origin uses request_origin.startswith(allowed), allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests without preflight and invoke tools/call without an API key, including file writes that persist agent instructions. This issue is fixed in version 4.6.58.

Summary

The PraisonAI MCP server exposes an HTTP-stream transport (praisonai mcp serve --transport http-stream) that binds to localhost and, by default, has no API key. Its only access control for browser-originated requests is an Origin allowlist, which the code implements as required by the MCP 2025-11-25 security guidance. The allowlist check uses a prefix match (request_origin.startswith(allowed)), so any Origin whose string begins with http://localhost or http://127.0.0.1 is accepted, for example http://localhost.attacker.com. An attacker who registers such a hostname and serves a page from it can, when a victim visits the page, issue cross-site requests that the MCP server accepts and executes without authentication. Because the request can be sent as a CORS "simple request" (Content-Type: text/plain, which the server still parses as JSON), it requires no preflight, and because tools/call does not require a session, a single forged request executes an MCP tool. This is a blind cross-site request forgery against a developer's local agent runtime. A natural end-to-end impact is persistent prompt injection: the forged request creates a rule file that the agent runtime loads with activation "always", so attacker-controlled instructions are injected into every subsequent agent run on the victim's machine.

Details

The HTTP-stream transport validates the Origin header in transports/http_stream.py. The allowlist is built for a localhost bind, then matched with startswith:

# __init__: default allowlist when binding to localhost
self.allowed_origins = ["http://localhost", "http://127.0.0.1",
                        "https://localhost", "https://127.0.0.1"]

def _validate_origin(self, request_origin):
    if request_origin is None:
        return True                      # no Origin -> allowed
    if self.allowed_origins is None:
        return False
    for allowed in self.allowed_origins:
        if request_origin == allowed or request_origin.startswith(allowed):
            return True                  # prefix match: the bypass
    return False

"http://localhost.attacker.com".startswith("http://localhost") is True, so the request is accepted. The attacker only needs to host the malicious page on a domain whose name begins with localhost or 127.0.0.1 (a subdomain label such as localhost.attacker.com), which makes the browser send Origin: http://localhost.attacker.com.

Three further properties make this directly reachable from a web page:

1. No authentication by default. In cli.py cmd_serve, --api-key defaults to None, and in mcp_post the auth check is skipped entirely when no key is configured:

if self.api_key:                          # None by default -> block skipped
    auth_header = request.headers.get("Authorization", "")
    ...

2. No preflight required. The body is parsed with await request.json(), which reads the raw body regardless of Content-Type. A page can therefore send the JSON-RPC payload as a CORS "simple request" with Content-Type: text/plain and no custom headers, which the browser delivers without an OPTIONS preflight. The response is not readable cross-origin, but the side effect has already occurred (blind CSRF).

3. No session required for tools/call. The session check only rejects when a session id is present but unknown:

session_id = request.headers.get("MCP-Session-Id") or request.headers.get("Mcp-Session-Id")
if session_id and session_id not in self._sessions:
    return JSONResponse({"error": "Session not found"}, status_code=404)

With no session header, session_id is None and the request proceeds straight to the dispatcher, which calls the tool handler with no authorization (server.py _handle_tools_call: result = tool.handler(**arguments)).

End-to-end impact via the rules tool. The unauthenticated praisonai.rules.create tool writes a file into the global rules directory (mcp_server/adapters/cli_tools.py confines the name to…

Summary

The PraisonAI MCP server exposes an HTTP-stream transport (praisonai mcp serve --transport http-stream) that binds to localhost and, by default, has no API key. Its only access control for browser-originated requests is an Origin allowlist, which the code implements as required by the MCP 2025-11-25 security guidance. The allowlist check uses a prefix match (request_origin.startswith(allowed)), so any Origin whose string begins with http://localhost or http://127.0.0.1 is accepted, for example http://localhost.attacker.com. An attacker who registers such a hostname and serves a page from it can, when a victim visits the page, issue cross-site requests that the MCP server accepts and executes without authentication. Because the request can be sent as a CORS "simple request" (Content-Type: text/plain, which the server still parses as JSON), it requires no preflight, and because tools/call does not require a session, a single forged request executes an MCP tool. This is a blind cross-site request forgery against a developer's local agent runtime. A natural end-to-end impact is persistent prompt injection: the forged request creates a rule file that the agent runtime loads with activation "always", so attacker-controlled instructions are injected into every subsequent agent run on the victim's machine.

Details

The HTTP-stream transport validates the Origin header in transports/http_stream.py. The allowlist is built for a localhost bind, then matched with startswith:

# __init__: default allowlist when binding to localhost
self.allowed_origins = ["http://localhost", "http://127.0.0.1",
                        "https://localhost", "https://127.0.0.1"]

def _validate_origin(self, request_origin):
    if request_origin is None:
        return True                      # no Origin -> allowed
    if self.allowed_origins is None:
        return False
    for allowed in self.allowed_origins:
        if request_origin == allowed or request_origin.startswith(allowed):
            return True                  # prefix match: the bypass
    return False

"http://localhost.attacker.com".startswith("http://localhost") is True, so the request is accepted. The attacker only needs to host the malicious page on a domain whose name begins with localhost or 127.0.0.1 (a subdomain label such as localhost.attacker.com), which makes the browser send Origin: http://localhost.attacker.com.

Three further properties make this directly reachable from a web page:

1. No authentication by default. In cli.py cmd_serve, --api-key defaults to None, and in mcp_post the auth check is skipped entirely when no key is configured:

if self.api_key:                          # None by default -> block skipped
    auth_header = request.headers.get("Authorization", "")
    ...

2. No preflight required. The body is parsed with await request.json(), which reads the raw body regardless of Content-Type. A page can therefore send the JSON-RPC payload as a CORS "simple request" with Content-Type: text/plain and no custom headers, which the browser delivers without an OPTIONS preflight. The response is not readable cross-origin, but the side effect has already occurred (blind CSRF).

3. No session required for tools/call. The session check only rejects when a session id is present but unknown:

session_id = request.headers.get("MCP-Session-Id") or request.headers.get("Mcp-Session-Id")
if session_id and session_id not in self._sessions:
    return JSONResponse({"error": "Session not found"}, status_code=404)

With no session header, session_id is None and the request proceeds straight to the dispatcher, which calls the tool handler with no authorization (server.py _handle_tools_call: result = tool.handler(**arguments)).

End-to-end impact via the rules tool. The unauthenticated praisonai.rules.create tool writes a file into the global rules directory (mcp_server/adapters/cli_tools.py confines the name to…