CVE-2026-57112 — PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools

Affected: MervinPraison PraisonAI, MervinPraison praisonaiagents

PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, ToolsMCPServer.run_sse() in src/praisonai-agents/praisonaiagents/mcp/mcp_server.py mounts SseServerTransport on the legacy /sse and /messages/ endpoints without default Host, Origin, or authentication enforcement. A malicious website can use DNS rebinding against a reachable local or internal SSE server, supply attacker-controlled Host and Origin headers, enumerate registered tools, and invoke them with the server user's privileges. The Streamable HTTP transport rejects the same hostile Origin, which isolates the flaw to the legacy SSE wrapper. An initial remediation was released in praisonaiagents 1.6.59 and PraisonAI 4.6.59.

GHSA-vmf9-xx9w-86wx — PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools

Affected: PyPI: praisonaiagents, PyPI: praisonai

# PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools

## Summary

`praisonaiagents.mcp.ToolsMCPServer.run_sse()` builds a Starlette MCP HTTP+SSE server around `mcp.server.sse.SseServerTransport`. The server exposes `/sse` and `/messages/`, but it does not validate `Origin`, does not validate `Host`, and does not require any authentication.

This is reachable through supported PraisonAI code paths that wrap configured MCP server tools and re-expose them over legacy SSE:

- `praisonai mcp run <name> --transport sse` - `praisonai serve mcp --name <name> --transport sse` - direct use of `ToolsMCPServer(...).run_sse(...)` or `launch_tools_mcp_server(..., transport="sse")`

A malicious website can use DNS rebinding against a local or internal PraisonAI SSE MCP server and send requests with attacker-controlled `Host` and `Origin` headers. The local PoV binds only to `127.0.0.1`, sends an attacker `Host` and `Origin`, lists the registered tool, and invokes it successfully.

The same attacker `Origin` is rejected by PraisonAI's current Streamable HTTP transport with HTTP 403. The vulnerability is therefore a sibling transport guard gap in the legacy SSE wrapper, not intended behavior.

## Affected product

- Repository: `MervinPraison/PraisonAI` - Packages: - `praisonaiagents` - `praisonai` - Primary component: `src/praisonai-agents/praisonaiagents/mcp/mcp_server.py` - CLI wrappers: - `src/praisonai/praisonai/cli/commands…

Most recent entries from all

CVE-2026-57112 — PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools

GHSA-vmf9-xx9w-86wx — PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools