CVE-2026-57124

PraisonAI, an open-source multi-agent teams framework, ships default UI host applications that expose a POST /api/mcp/connect endpoint without mandatory authentication. The endpoint accepts caller-controlled command and args values that PraisonAIUI passes directly to StdioMCPClient to spawn a local process, and because the UI binds to 0.0.0.0 by default, any network-reachable client can trigger arbitrary command execution as the UI service account. Code execution succeeds even if the subsequent MCP handshake fails, so a failed connection is not a reliable indicator that exploitation was blocked. Anyone running a PraisonAI UI version prior to 4.6.59 that is reachable by untrusted clients (or on a shared network segment) is affected. No public proof of concept is known and the flaw is not on the CISA KEV list, so exploitation status is currently none known, though the flaw is trivially exploitable by anyone who can reach the port.

What to do: Upgrade to PraisonAI 4.6.59 or later immediately. If immediate upgrade is not possible, reconfigure the UI to bind to 127.0.0.1 instead of 0.0.0.0, firewall the UI port from untrusted networks, and run the UI under a minimally privileged service account. Review server logs for unexpected POST /api/mcp/connect requests containing unusual command or args values as evidence of probing or abuse.