Description

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands bind to 0.0.0.0 by default, a reachable unauthenticated client can execute commands as the UI service account even when the MCP handshake later fails. This vulnerability is fixed in 4.6.59.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-14T16:17:13.417Z",
  "pubdate": "2026-09-14T16:17:13.417Z",
  "executiveSummary": "PraisonAI versions prior to 4.6.59 are affected by an unauthenticated command execution vulnerability located within the UI host application's MCP integration.\nThe flaw stems from the insecure implementation of the POST /api/mcp/connect endpoint, which fails to enforce mandatory authentication and permits user-supplied input to influence local process execution.\nBecause the default configuration binds the service to 0.0.0.0, the interface is exposed to unauthorized remote actors, enabling them to execute arbitrary system commands with the privileges of the UI service account.\nThis vulnerability presents a critical risk as it allows for full system compromise, data exfiltration, or lateral movement within the network, even if the subsequent MCP protocol handshake fails.\nExploitation does not require prior authentication or elevated privileges, making it highly accessible to external attackers who can reach the service endpoint.",
  "technicalDetails": "The vulnerability resides in the PraisonAI UI host application, specifically within the handling logic for the /api/mcp/connect endpoint. The root cause is a lack of authentication controls on this endpoint, combined with improper validation of user-controlled input parameters.\nWhen a request is sent to POST /api/mcp/connect, the application accepts 'command' and 'args' values directly from the request body. These values are passed to the StdioMCPClient component, which is designed to spawn local processes as part of the Model Context Protocol (MCP) initialization process.\nThe attack flow proceeds as follows: An unauthenticated attacker sends a crafted POST request to the target UI host application. The payload includes malicious command strings within the 'command' and 'args' fields. Upon receiving this request, the application attempts to initiate a StdioMCPClient instance using the attacker-supplied parameters. Consequently, the operating system executes the requested command with the security context of the UI service account.\nA critical aspect of this flaw is the binding behavior of the UI service. By default, the application binds to 0.0.0.0, which ensures the service is listening on all available network interfaces, including public-facing ones. This increases the attack surface, allowing remote exploitation from any reachable network host.\nNotably, the command execution occurs during the process initiation phase. The vulnerability is triggered even if the MCP handshake protocol fails immediately afterward, as the process spawning logic precedes the completion of the protocol verification. This ensures that the attacker's payload is executed regardless of whether a valid MCP connection is established.\nThe impact of this vulnerability is total system compromise. Since the process runs as the service account, the attacker inherits the system permissions assigned to that account. This can lead to arbitrary code execution, unauthorized access to sensitive files, environment variable exfiltration, or the installation of persistent backdoors on the host machine. This vulnerability affects all PraisonAI versions prior to 4.6.59."
}