Description

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.run_sse and launch_tools_mcp_server bind to 0.0.0.0 and create /sse and /messages/ routes without invoking the available SecurityConfig authentication, origin-validation, or DNS-rebinding controls. Any reachable client can list and invoke registered tools, and a browser can target a local instance through DNS rebinding, with impact determined by the registered file, shell, and code-execution tools. This vulnerability is fixed in praisonaiagents 1.6.59.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-14T15:17:05.753Z",
  "pubdate": "2026-09-14T15:17:05.753Z",
  "executiveSummary": "The praisonaiagents library, specifically in versions prior to 1.6.59, contains a critical security vulnerability involving unauthenticated access to the ToolsMCPServer interface. The vulnerability arises because the service binds to the 0.0.0.0 network interface and exposes /sse and /messages/ routes without implementing mandated security controls.\nThis flaw effectively bypasses required authentication, origin-validation, and DNS-rebinding protections. By failing to integrate SecurityConfig, the application allows any network-reachable client to enumerate and invoke registered tools. Given that these tools often include system-level capabilities such as shell execution, file system access, and arbitrary code execution, the impact of unauthorized access is severe.\nAn attacker can exploit this misconfiguration from a remote network or via browser-based attacks using DNS rebinding techniques. The absence of access controls turns a local development or server utility into an open execution gateway, providing an attacker with the permissions of the underlying process. The vulnerability represents a significant risk to the confidentiality, integrity, and availability of the host system, necessitating an immediate upgrade to version 1.6.59 or later.",
  "technicalDetails": "The vulnerability resides within the ToolsMCPServer class, specifically in the run_sse and launch_tools_mcp_server functions. The root cause is a failure to enforce the SecurityConfig module, which was designed to provide essential security primitives including authentication, origin-validation, and DNS-rebinding protection. By binding to 0.0.0.0, the service listens on all available network interfaces rather than restricting access to localhost, thereby widening the attack surface to any reachable endpoint.\nThe exploitation process initiates by identifying an active instance of the MCP server. Because the /sse and /messages/ routes are exposed without session validation, an attacker does not require valid credentials to interact with the service. The attack flow typically proceeds as follows: First, the attacker maps the available toolset by querying the exposed endpoints, which return a list of registered capabilities. Second, the attacker selects a target tool, such as a shell executor or file system utility. Third, the attacker crafts a malicious request targeting the /messages/ route to invoke the selected tool with arbitrary arguments.\nIn scenarios involving DNS rebinding, an attacker can trick a victim's browser into interacting with the local instance. By inducing the browser to navigate to a malicious site that initiates a DNS rebinding attack, the attacker can force the victim's local browser to serve as a proxy, sending authenticated-appearing requests to the vulnerable 0.0.0.0-bound service. This bypasses typical Same-Origin Policy (SOP) protections because the browser interacts with the service from the perspective of a local application.\nThe post-exploitation impact is determined by the specific tools registered within the praisonaiagents environment. If the server is configured with tools capable of shell command execution, an attacker can achieve remote code execution (RCE) on the host machine. If file-manipulation tools are exposed, the attacker may read sensitive configuration files, overwrite binary payloads, or exfiltrate application data. Because these actions are performed with the privileges of the user running the praisonaiagents process, the potential for lateral movement and full system compromise is substantial. The vulnerability exists in all versions before 1.6.59, and no internal security controls effectively mitigate this threat in the affected code base until the patch is applied."
}