CVE-2026-57139

PraisonAI versions 1.5.0 through 1.7.1 ship an MCP HTTP server whose startHttp() method binds without a host restriction and passes every incoming POST request to handleRequest() with no authentication or authorization checks. Any attacker who can reach the listening port can invoke MCP operations such as tools/list, tools/call, resources/read, or prompts/get. Because registered handlers execute with the server's own credentials and process privileges, this can lead to arbitrary tool execution, disclosure of registered resources and data, and full compromise of confidentiality, integrity, and availability (CVSS 9.8). Developers or teams running the vulnerable HTTP MCP server from Praisonai-TS in affected versions are exposed, particularly if the port is bound to a public or shared-network interface. No public proof of concept is known and the flaw is not listed in CISA's KEV catalog.

What to do: Upgrade PraisonAI to version 1.7.2 or later (preferably the newest release, since 1.7.2 was described as only an initial remediation). Until patched, do not expose the MCP HTTP port: bind it to localhost or a private interface and restrict access with a firewall or an authenticating reverse proxy. Review logs for unexpected POSTs to the MCP endpoint and rotate any credentials, API keys, or tokens configured in tool handlers that a reachable server may have used.