Description

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, MCPSecurity.evaluatePolicy() in src/praisonai-ts/src/mcp/security.ts invokes the configured credential validator only when AuthMethod is api-key or bearer. Basic and OAuth policies accept any non-empty Authorization header without calling auth.validate(), then return an authenticated result, allowing callers with invalid credentials to access MCP tools and resources protected by those policies. This issue is fixed in version 1.7.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-15T11:17:10.583Z",
  "pubdate": "2026-09-15T11:17:10.583Z",
  "executiveSummary": "PraisonAI versions 1.5.1 through 1.7.2 contain a critical authentication bypass vulnerability within the MCPSecurity module.\nThe vulnerability resides in the evaluatePolicy() function, which fails to execute credential validation logic for Basic and OAuth authentication methods.\nBy providing any non-empty string in the Authorization header, an unauthenticated attacker can circumvent security controls and gain unauthorized access to protected MCP tools and resources.\nThis flaw allows for unauthorized execution of sensitive operations, posing a significant risk to the integrity and confidentiality of the multi-agent system.\nThe vulnerability is limited to the specific logic handling of authentication policies and does not require complex prerequisites other than the ability to supply an arbitrary header value.\nUsers are strongly advised to update to version 1.7.2 or later to ensure proper enforcement of credential validation.",
  "technicalDetails": "The vulnerability is located in the src/praisonai-ts/src/mcp/security.ts file, specifically within the MCPSecurity.evaluatePolicy() function.\nThe root cause is a conditional logic error in the policy evaluation workflow where the security implementation only invokes the configured credential validator when the AuthMethod is explicitly set to 'api-key' or 'bearer'.\nFor policies configured with 'Basic' or 'OAuth' authentication types, the function defaults to a permissive state. Instead of invoking auth.validate() to verify the authenticity of the provided credentials, the system checks only for the existence of a non-empty Authorization header.\nIf the header is non-empty, the function immediately returns an authenticated result, effectively bypassing the security layer and granting access to protected MCP tools regardless of the validity of the supplied credentials.\nAn attack flow is straightforward: an attacker observes the system's reliance on MCP resources and identifies that Basic or OAuth authentication is in use. The attacker crafts an HTTP request including an Authorization header containing any arbitrary or junk string. Upon reaching the MCPSecurity.evaluatePolicy() method, the component skips the validation step, treats the arbitrary string as a successful authentication event, and grants the requested access.\nThis exposure allows unauthorized parties to interact with MCP tools, potentially leading to unauthorized data exfiltration, system manipulation, or further escalation within the multi-agent team environment.\nThe vulnerability affects all versions of PraisonAI from 1.5.1 up to 1.7.2, where the flawed conditional check is present in the TypeScript source code.\nThe lack of strict validation for Basic and OAuth methods essentially renders those authentication protocols inert, providing a false sense of security while leaving the system fully exposed to any request containing a minimal header payload."
}