CVE-2026-57123

In praisonaiagents before 1.6.59, the MCP tools server (ToolsMCPServer.run_sse and launch_tools_mcp_server) binds to 0.0.0.0 and exposes /sse and /messages/ endpoints while skipping the library's own SecurityConfig authentication, origin validation, and DNS-rebinding protections. Any client that can reach the listening port can enumerate the registered tools and invoke them directly, without credentials. Because PraisonAI agents typically register file-access, shell, and code-execution tools, this amounts to unauthenticated remote code execution on the host, and even a localhost-only instance can be attacked via DNS rebinding from a victim's browser. Anyone running the tools MCP server on praisonaiagents prior to 1.6.59 is affected. No public proof-of-concept exists and no exploitation has been observed, but the flaw is trivially discoverable through port scans or a malicious web page.

What to do: Upgrade praisonaiagents to version 1.6.59 or later, where the MCP server enforces SecurityConfig authentication, origin validation, and DNS-rebinding protections. If upgrading is delayed, avoid running launch_tools_mcp_server or ToolsMCPServer.run_sse on untrusted networks, bind the server to 127.0.0.1 instead of 0.0.0.0, and restrict the port with host firewall rules. Check logs for unexpected /sse or /messages/ connections and rotate any credentials or secrets reachable through the registered shell, file, and code-execution tools.