CVE-2026-57112

PraisonAI's ToolsMCPServer.run_sse() in praisonaiagents mounts an SseServerTransport on the legacy /sse and /messages/ endpoints without enforcing Host or Origin validation or any authentication, leaving the flaw isolated to the legacy SSE wrapper (the newer Streamable HTTP transport rejects hostile origins). The vulnerability is triggered when a victim visits a malicious website that performs DNS rebinding against a reachable local or internal SSE server, supplying attacker-controlled Host and Origin headers. The attacker can then enumerate the registered MCP tools and invoke them with the privileges of the server user, impacting confidentiality, integrity, and availability (CVSS 3.1: 8.3, high). Affected software includes praisonaiagents 0.6.0 through before 1.6.59 and PraisonAI 3.10.0 through before 4.6.59, with fixes shipped in 1.6.59 and 4.6.59 respectively. No public proof of concept exists and no exploitation in the wild has been observed.

What to do: Upgrade praisonaiagents to 1.6.59 or later and PraisonAI to 4.6.59 or later, which contain the remediation. If immediate upgrade is not possible, switch from the legacy SSE transport to the Streamable HTTP transport (which rejects hostile Origins) and avoid binding the SSE server to interfaces reachable from browsers or untrusted networks. Review logs of any previously exposed SSE servers for unexpected Host/Origin headers or tool invocations you did not initiate.