Description

PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, ToolsMCPServer.run_sse() in src/praisonai-agents/praisonaiagents/mcp/mcp_server.py mounts SseServerTransport on the legacy /sse and /messages/ endpoints without default Host, Origin, or authentication enforcement. A malicious website can use DNS rebinding against a reachable local or internal SSE server, supply attacker-controlled Host and Origin headers, enumerate registered tools, and invoke them with the server user's privileges. The Streamable HTTP transport rejects the same hostile Origin, which isolates the flaw to the legacy SSE wrapper. An initial remediation was released in praisonaiagents 1.6.59 and PraisonAI 4.6.59.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-09-15T11:17:10.290Z",
  "pubdate": "2026-09-15T11:17:10.290Z",
  "executiveSummary": "The PraisonAI multi-agent framework contains a critical vulnerability within its legacy Server-Sent Events (SSE) implementation, leading to potential unauthorized command execution. The flaw exists in the ToolsMCPServer.run_sse() function, which fails to enforce mandatory authentication, Origin header validation, or Host header verification on legacy endpoints (/sse and /messages/).\nThis vulnerability is classified as an authentication bypass and cross-site request vulnerability. An attacker can exploit this via DNS rebinding to interact with the local SSE server from a malicious website. By masquerading as a legitimate request, the attacker can enumerate registered tools and invoke arbitrary operations with the context and privileges of the local system user. The impact is significant, as it grants unauthorized actors the ability to leverage internal tools and potentially perform remote code execution or data exfiltration depending on the capabilities of the registered MCP tools. The issue specifically affects the legacy transport wrapper, while the modern Streamable HTTP transport remains unaffected due to robust origin checking. Affected versions include praisonaiagents 0.6.0 through 1.6.58 and PraisonAI 3.10.0 through 4.6.58.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the SseServerTransport within src/praisonai-agents/praisonaiagents/mcp/mcp_server.py. The legacy SSE wrapper fails to implement standard security controls required for web-based RPC interfaces. Specifically, the /sse and /messages/ endpoints do not validate the 'Host' or 'Origin' headers of incoming HTTP requests, nor do they implement any authentication mechanism to verify the requester's identity.\nThe attack vector relies on DNS rebinding. An attacker lures a target user to a malicious website while the user has an active PraisonAI instance running locally. The malicious site initiates a DNS rebinding attack to bypass same-origin policy (SOP) restrictions, effectively allowing the browser to send cross-origin requests to the local machine where the SSE server is listening. Since the SseServerTransport does not enforce Origin header validation, it treats these requests as trusted traffic.\nThe attack flow proceeds as follows: 1) The attacker discovers or targets a user running an affected version of PraisonAI. 2) The victim visits a malicious site that executes a DNS rebinding script. 3) The script directs the victim's browser to send requests to the local /sse and /messages/ endpoints. 4) Because the server lacks authentication and origin checks, it accepts the attacker's supplied headers. 5) The attacker enumerates available tools registered within the MCP environment. 6) The attacker invokes these tools, executing commands or logic with the privileges of the local user session.\nThis behavior contrasts with the Streamable HTTP transport implementation, which correctly identifies and rejects requests originating from hostile or unauthorized origins, effectively isolating the vulnerability to the legacy SSE wrapper. The exploit provides the attacker with a bridge to the local development environment or production server infrastructure, facilitating unauthorized tool utilization. Authentication requirements are non-existent, meaning any request that reaches the interface is treated as legitimate, posing a severe risk for users running the service in environments accessible via a browser or network."
}