Most recent entries from all

EUVD-2026-368151

2026-10-02T18:38:53.638027+00:00

EUVD-2026-368151

fkie_cve-2026-57124

2026-10-02T18:38:53.638065+00:00

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands bind to 0.0.0.0 by default, a reachable unauthenticated client can execute commands as the UI service account even when the MCP handshake later fails. This vulnerability is fixed in 4.6.59.

GHSA-p75f-6fp4-p57w — PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS C…

2026-10-02T18:38:53.638099+00:00

Affected: PyPI: praisonai

# Unauthenticated PraisonAI UI MCP connect endpoint executes attacker-chosen local commands

## Summary

PraisonAI v4.6.48 exposes the PraisonAIUI MCP client management API through the default UI host apps without authentication. A remote unauthenticated client can send `POST /api/mcp/connect` with a `command` and `args` field. The endpoint passes those values into the MCP stdio client, which starts the attacker-selected local process as the PraisonAI UI service user.

The issue is reachable through PraisonAI's hosted UI integration (`praisonai ui`, `praisonai ui agents`, `praisonai claw`, and any app using `praisonai.integration.host_app.create_host_app()` / `build_host_app()`). `praisonai ui` and related Typer UI commands bind to `0.0.0.0` by default.

## Affected Versions

Confirmed affected:

- `praisonai` v4.6.48 - Commit tested: `d5f1114aaf1a2e9f121a6e66b929149ca2201f1d` - Tag tested: `v4.6.48` - Pinned UI dependency: `aiui==0.3.121` from `src/praisonai/uv.lock`

Likely affected:

- Any PraisonAI release that exposes `aiui` / `praisonaiui` `create_app()` through the PraisonAI UI host apps without authentication and includes the `mcp` dependency. I only confirmed the latest release during this audit.

## Severity

Reasoning:

- `AV`: the vulnerable endpoint is an HTTP API route. - `AC`: a single POST request is sufficient. - `PR`: default UI host apps do not require credentials unless opt-in auth is configured. - `UI`: no victim interaction is needed after the server is…

PYSEC-2026-3517 — PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS C…

2026-10-02T18:38:53.638173+00:00