CVE-2026-57112

PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, ToolsMCPServer.run_sse() in src/praisonai-agents/praisonaiagents/mcp/mcp_server.py mounts SseServerTransport on the legacy /sse and /messages/ endpoints without default Host, Origin, or authentication enforcement. A malicious website can use DNS rebinding against a reachable local or internal SSE server, supply attacker-controlled Host and Origin headers, enumerate registered tools, and invoke them with the server user's privileges. The Streamable HTTP transport rejects the same hostile Origin, which isolates the flaw to the legacy SSE wrapper. An initial remediation was released in praisonaiagents 1.6.59 and PraisonAI 4.6.59.

PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, ToolsMCPServer.run_sse() in src/praisonai-agents/praisonaiagents/mcp/mcp_server.py mounts SseServerTransport on the legacy /sse and /messages/ endpoints without default Host, Origin, or authentication enforcement. A malicious website can use DNS rebinding against a reachable local or internal SSE server, supply attacker-controlled Host and Origin headers, enumerate registered tools, and invoke them with the server user's privileges. The Streamable HTTP transport rejects the same hostile Origin, which isolates the flaw to the legacy SSE wrapper. An initial remediation was released in praisonaiagents 1.6.59 and PraisonAI 4.6.59.

PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools

Summary

praisonaiagents.mcp.ToolsMCPServer.run_sse() builds a Starlette MCP HTTP+SSE server around mcp.server.sse.SseServerTransport. The server exposes /sse and /messages/, but it does not validate Origin, does not validate Host, and does not require any authentication.

This is reachable through supported PraisonAI code paths that wrap configured MCP server tools and re-expose them over legacy SSE:

• praisonai mcp run <name> --transport sse
• praisonai serve mcp --name <name> --transport sse
• direct use of ToolsMCPServer(...).run_sse(...) or launch_tools_mcp_server(..., transport="sse")

A malicious website can use DNS rebinding against a local or internal PraisonAI SSE MCP server and send requests with attacker-controlled Host and Origin headers. The local PoV binds only to 127.0.0.1, sends an attacker Host and Origin, lists the registered tool, and invokes it successfully.

The same attacker Origin is rejected by PraisonAI's current Streamable HTTP transport with HTTP 403. The vulnerability is therefore a sibling transport guard gap in the legacy SSE wrapper, not intended behavior.

Affected product

• Repository: MervinPraison/PraisonAI
• Packages:
  • praisonaiagents
  • praisonai
• Primary component: src/praisonai-agents/praisonaiagents/mcp/mcp_server.py
• CLI wrappers:
  • src/praisonai/praisonai/cli/commands/mcp.py
  • src/praisonai/praisonai/cli/commands/serve.py
• Latest verified release/current head:
  • praisonaiagents 1.6.58
  • PraisonAI 4.6.58
  • repo head 1ad58ca02975ff1398efeda694ea2ab78f20cf3e

Suggested affected ranges:

• praisonaiagents >= 0.6.0, <= 1.6.58
• praisonai >= 3.10.0, <= 4.6.58

No fixed version is known at submission time.

Confirmed source sweep:

v3.0.0   ToolsMCPServer.run_sse helper present, no Origin/Host/auth checks
v3.10.0  praisonai mcp run --transport sse wraps configured tools into helper
v3.12.3  praisonai serve mcp --name --transport sse wraps configured tools
v4.0.0   same vulnerable helper and CLI wrapping paths
v4.4.12  same vulnerable helper and CLI wrapping paths
v4.5.0   same vulnerable helper and CLI wrapping paths
v4.5.56  same vulnerable helper and CLI wrapping paths
v4.5.139 same vulnerable helper and CLI wrapping paths
v4.6.57  same vulnerable helper and CLI wrapping paths
v4.6.58  same vulnerable helper and dynamic PoV succeeds

Impact

If a PraisonAI user starts a local or internal legacy SSE MCP server with registered tools, an attacker who gets that user to visit a malicious website can use DNS rebinding to interact with the SSE server through the browser. The attacker can discover exposed tools and invoke them as the local user.

Impact depends on the configured tools. In realistic PraisonAI MCP deployments, registered tools may access local files, repositories, issue trackers, cloud APIs, internal services, or other automation targets. This can lead to confidentiality, integrity, and availability impact for the resources reachable by the exposed tools.

The PoV is local-only and harmless. It exposes one marker tool that writes a canary string to a temporary directory.

Root cause

Current ToolsMCPServer.run_sse() constructs a Starlette app directly:

sse_path = "/sse"
messages_path = "/messages/"
sse_transport = SseServerTransport(messages_path)

async def handle_sse(request: Request):
    async with sse_transport.connect_sse(
        request.scope, request.receive, request._send
    ) as (read_stream, write_stream):
        await mcp._mcp_server.run(
            read_stream,
            write_stream,
            mcp._mcp_server.create_initialization_options()
        )

app = Starlette(
    debug=self._debug,
    routes=[
        Route(sse_path, endpoint=handle_sse),
        Mount(messages_path, app=sse_transport.handle_post_message),
    ]
)

uvicorn.run(app,…

PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, ToolsMCPServer.run_sse() in src/praisonai-agents/praisonaiagents/mcp/mcp_server.py mounts SseServerTransport on the legacy /sse and /messages/ endpoints without default Host, Origin, or authentication enforcement. A malicious website can use DNS rebinding against a reachable local or internal SSE server, supply attacker-controlled Host and Origin headers, enumerate registered tools, and invoke them with the server user's privileges. The Streamable HTTP transport rejects the same hostile Origin, which isolates the flaw to the legacy SSE wrapper. An initial remediation was released in praisonaiagents 1.6.59 and PraisonAI 4.6.59.

PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, ToolsMCPServer.run_sse() in src/praisonai-agents/praisonaiagents/mcp/mcp_server.py mounts SseServerTransport on the legacy /sse and /messages/ endpoints without default Host, Origin, or authentication enforcement. A malicious website can use DNS rebinding against a reachable local or internal SSE server, supply attacker-controlled Host and Origin headers, enumerate registered tools, and invoke them with the server user's privileges. The Streamable HTTP transport rejects the same hostile Origin, which isolates the flaw to the legacy SSE wrapper. An initial remediation was released in praisonaiagents 1.6.59 and PraisonAI 4.6.59.

PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools

Summary

praisonaiagents.mcp.ToolsMCPServer.run_sse() builds a Starlette MCP HTTP+SSE server around mcp.server.sse.SseServerTransport. The server exposes /sse and /messages/, but it does not validate Origin, does not validate Host, and does not require any authentication.

This is reachable through supported PraisonAI code paths that wrap configured MCP server tools and re-expose them over legacy SSE:

• praisonai mcp run <name> --transport sse
• praisonai serve mcp --name <name> --transport sse
• direct use of ToolsMCPServer(...).run_sse(...) or launch_tools_mcp_server(..., transport="sse")

A malicious website can use DNS rebinding against a local or internal PraisonAI SSE MCP server and send requests with attacker-controlled Host and Origin headers. The local PoV binds only to 127.0.0.1, sends an attacker Host and Origin, lists the registered tool, and invokes it successfully.

The same attacker Origin is rejected by PraisonAI's current Streamable HTTP transport with HTTP 403. The vulnerability is therefore a sibling transport guard gap in the legacy SSE wrapper, not intended behavior.

Affected product

• Repository: MervinPraison/PraisonAI
• Packages:
  • praisonaiagents
  • praisonai
• Primary component: src/praisonai-agents/praisonaiagents/mcp/mcp_server.py
• CLI wrappers:
  • src/praisonai/praisonai/cli/commands/mcp.py
  • src/praisonai/praisonai/cli/commands/serve.py
• Latest verified release/current head:
  • praisonaiagents 1.6.58
  • PraisonAI 4.6.58
  • repo head 1ad58ca02975ff1398efeda694ea2ab78f20cf3e

Suggested affected ranges:

• praisonaiagents >= 0.6.0, <= 1.6.58
• praisonai >= 3.10.0, <= 4.6.58

No fixed version is known at submission time.

Confirmed source sweep:

v3.0.0   ToolsMCPServer.run_sse helper present, no Origin/Host/auth checks
v3.10.0  praisonai mcp run --transport sse wraps configured tools into helper
v3.12.3  praisonai serve mcp --name --transport sse wraps configured tools
v4.0.0   same vulnerable helper and CLI wrapping paths
v4.4.12  same vulnerable helper and CLI wrapping paths
v4.5.0   same vulnerable helper and CLI wrapping paths
v4.5.56  same vulnerable helper and CLI wrapping paths
v4.5.139 same vulnerable helper and CLI wrapping paths
v4.6.57  same vulnerable helper and CLI wrapping paths
v4.6.58  same vulnerable helper and dynamic PoV succeeds

Impact

If a PraisonAI user starts a local or internal legacy SSE MCP server with registered tools, an attacker who gets that user to visit a malicious website can use DNS rebinding to interact with the SSE server through the browser. The attacker can discover exposed tools and invoke them as the local user.

Impact depends on the configured tools. In realistic PraisonAI MCP deployments, registered tools may access local files, repositories, issue trackers, cloud APIs, internal services, or other automation targets. This can lead to confidentiality, integrity, and availability impact for the resources reachable by the exposed tools.

The PoV is local-only and harmless. It exposes one marker tool that writes a canary string to a temporary directory.

Root cause

Current ToolsMCPServer.run_sse() constructs a Starlette app directly:

sse_path = "/sse"
messages_path = "/messages/"
sse_transport = SseServerTransport(messages_path)

async def handle_sse(request: Request):
    async with sse_transport.connect_sse(
        request.scope, request.receive, request._send
    ) as (read_stream, write_stream):
        await mcp._mcp_server.run(
            read_stream,
            write_stream,
            mcp._mcp_server.create_initialization_options()
        )

app = Starlette(
    debug=self._debug,
    routes=[
        Route(sse_path, endpoint=handle_sse),
        Mount(messages_path, app=sse_transport.handle_post_message),
    ]
)

uvicorn.run(app,…

PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools

Summary

praisonaiagents.mcp.ToolsMCPServer.run_sse() builds a Starlette MCP HTTP+SSE server around mcp.server.sse.SseServerTransport. The server exposes /sse and /messages/, but it does not validate Origin, does not validate Host, and does not require any authentication.

This is reachable through supported PraisonAI code paths that wrap configured MCP server tools and re-expose them over legacy SSE:

• praisonai mcp run <name> --transport sse
• praisonai serve mcp --name <name> --transport sse
• direct use of ToolsMCPServer(...).run_sse(...) or launch_tools_mcp_server(..., transport="sse")

A malicious website can use DNS rebinding against a local or internal PraisonAI SSE MCP server and send requests with attacker-controlled Host and Origin headers. The local PoV binds only to 127.0.0.1, sends an attacker Host and Origin, lists the registered tool, and invokes it successfully.

The same attacker Origin is rejected by PraisonAI's current Streamable HTTP transport with HTTP 403. The vulnerability is therefore a sibling transport guard gap in the legacy SSE wrapper, not intended behavior.

Affected product

• Repository: MervinPraison/PraisonAI
• Packages:
  • praisonaiagents
  • praisonai
• Primary component: src/praisonai-agents/praisonaiagents/mcp/mcp_server.py
• CLI wrappers:
  • src/praisonai/praisonai/cli/commands/mcp.py
  • src/praisonai/praisonai/cli/commands/serve.py
• Latest verified release/current head:
  • praisonaiagents 1.6.58
  • PraisonAI 4.6.58
  • repo head 1ad58ca02975ff1398efeda694ea2ab78f20cf3e

Suggested affected ranges:

• praisonaiagents >= 0.6.0, <= 1.6.58
• praisonai >= 3.10.0, <= 4.6.58

No fixed version is known at submission time.

Confirmed source sweep:

v3.0.0   ToolsMCPServer.run_sse helper present, no Origin/Host/auth checks
v3.10.0  praisonai mcp run --transport sse wraps configured tools into helper
v3.12.3  praisonai serve mcp --name --transport sse wraps configured tools
v4.0.0   same vulnerable helper and CLI wrapping paths
v4.4.12  same vulnerable helper and CLI wrapping paths
v4.5.0   same vulnerable helper and CLI wrapping paths
v4.5.56  same vulnerable helper and CLI wrapping paths
v4.5.139 same vulnerable helper and CLI wrapping paths
v4.6.57  same vulnerable helper and CLI wrapping paths
v4.6.58  same vulnerable helper and dynamic PoV succeeds

Impact

If a PraisonAI user starts a local or internal legacy SSE MCP server with registered tools, an attacker who gets that user to visit a malicious website can use DNS rebinding to interact with the SSE server through the browser. The attacker can discover exposed tools and invoke them as the local user.

Impact depends on the configured tools. In realistic PraisonAI MCP deployments, registered tools may access local files, repositories, issue trackers, cloud APIs, internal services, or other automation targets. This can lead to confidentiality, integrity, and availability impact for the resources reachable by the exposed tools.

The PoV is local-only and harmless. It exposes one marker tool that writes a canary string to a temporary directory.

Root cause

Current ToolsMCPServer.run_sse() constructs a Starlette app directly:

sse_path = "/sse"
messages_path = "/messages/"
sse_transport = SseServerTransport(messages_path)

async def handle_sse(request: Request):
    async with sse_transport.connect_sse(
        request.scope, request.receive, request._send
    ) as (read_stream, write_stream):
        await mcp._mcp_server.run(
            read_stream,
            write_stream,
            mcp._mcp_server.create_initialization_options()
        )

app = Starlette(
    debug=self._debug,
    routes=[
        Route(sse_path, endpoint=handle_sse),
        Mount(messages_path, app=sse_transport.handle_post_message),
    ]
)

uvicorn.run(app,…

PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools

Summary

praisonaiagents.mcp.ToolsMCPServer.run_sse() builds a Starlette MCP HTTP+SSE server around mcp.server.sse.SseServerTransport. The server exposes /sse and /messages/, but it does not validate Origin, does not validate Host, and does not require any authentication.

This is reachable through supported PraisonAI code paths that wrap configured MCP server tools and re-expose them over legacy SSE:

• praisonai mcp run <name> --transport sse
• praisonai serve mcp --name <name> --transport sse
• direct use of ToolsMCPServer(...).run_sse(...) or launch_tools_mcp_server(..., transport="sse")

A malicious website can use DNS rebinding against a local or internal PraisonAI SSE MCP server and send requests with attacker-controlled Host and Origin headers. The local PoV binds only to 127.0.0.1, sends an attacker Host and Origin, lists the registered tool, and invokes it successfully.

The same attacker Origin is rejected by PraisonAI's current Streamable HTTP transport with HTTP 403. The vulnerability is therefore a sibling transport guard gap in the legacy SSE wrapper, not intended behavior.

Affected product

• Repository: MervinPraison/PraisonAI
• Packages:
  • praisonaiagents
  • praisonai
• Primary component: src/praisonai-agents/praisonaiagents/mcp/mcp_server.py
• CLI wrappers:
  • src/praisonai/praisonai/cli/commands/mcp.py
  • src/praisonai/praisonai/cli/commands/serve.py
• Latest verified release/current head:
  • praisonaiagents 1.6.58
  • PraisonAI 4.6.58
  • repo head 1ad58ca02975ff1398efeda694ea2ab78f20cf3e

Suggested affected ranges:

• praisonaiagents >= 0.6.0, <= 1.6.58
• praisonai >= 3.10.0, <= 4.6.58

No fixed version is known at submission time.

Confirmed source sweep:

v3.0.0   ToolsMCPServer.run_sse helper present, no Origin/Host/auth checks
v3.10.0  praisonai mcp run --transport sse wraps configured tools into helper
v3.12.3  praisonai serve mcp --name --transport sse wraps configured tools
v4.0.0   same vulnerable helper and CLI wrapping paths
v4.4.12  same vulnerable helper and CLI wrapping paths
v4.5.0   same vulnerable helper and CLI wrapping paths
v4.5.56  same vulnerable helper and CLI wrapping paths
v4.5.139 same vulnerable helper and CLI wrapping paths
v4.6.57  same vulnerable helper and CLI wrapping paths
v4.6.58  same vulnerable helper and dynamic PoV succeeds

Impact

If a PraisonAI user starts a local or internal legacy SSE MCP server with registered tools, an attacker who gets that user to visit a malicious website can use DNS rebinding to interact with the SSE server through the browser. The attacker can discover exposed tools and invoke them as the local user.

Impact depends on the configured tools. In realistic PraisonAI MCP deployments, registered tools may access local files, repositories, issue trackers, cloud APIs, internal services, or other automation targets. This can lead to confidentiality, integrity, and availability impact for the resources reachable by the exposed tools.

The PoV is local-only and harmless. It exposes one marker tool that writes a canary string to a temporary directory.

Root cause

Current ToolsMCPServer.run_sse() constructs a Starlette app directly:

sse_path = "/sse"
messages_path = "/messages/"
sse_transport = SseServerTransport(messages_path)

async def handle_sse(request: Request):
    async with sse_transport.connect_sse(
        request.scope, request.receive, request._send
    ) as (read_stream, write_stream):
        await mcp._mcp_server.run(
            read_stream,
            write_stream,
            mcp._mcp_server.create_initialization_options()
        )

app = Starlette(
    debug=self._debug,
    routes=[
        Route(sse_path, endpoint=handle_sse),
        Mount(messages_path, app=sse_transport.handle_post_message),
    ]
)

uvicorn.run(app,…