Description

PraisonAI is a multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp() in src/praisonai-ts/src/mcp/server.ts binds without a host restriction and forwards every HTTP POST request to handleRequest() without authentication or authorization. Any network client that can reach the port can call tools/list, tools/call, resources/read, or prompts/get, causing registered handlers to run with server-side credentials and process privileges or disclose registered data. An initial remediation was released in version 1.7.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-15T11:17:11.327Z",
  "pubdate": "2026-09-15T11:17:11.327Z",
  "executiveSummary": "PraisonAI versions 1.5.0 through 1.7.2 contain a critical vulnerability involving an unauthenticated HTTP interface. The vulnerability resides in the MCPServer.startHttp() function within src/praisonai-ts/src/mcp/server.ts.\nThe flaw allows any remote attacker with network access to the exposed port to interact with the system without authentication or authorization. By sending crafted HTTP POST requests to the server, an attacker can execute sensitive MCP (Model Context Protocol) methods, including tool execution and resource retrieval.\nThe risk is severe, as it enables unauthorized access to server-side credentials, execution of arbitrary tools with the privileges of the PraisonAI service, and potential disclosure of sensitive application data. No authentication is required for exploitation, and the service binds without host restriction, making it accessible to any client reaching the network interface. Immediate upgrade to a patched version is required to mitigate the risk of unauthorized system control and data exfiltration.",
  "technicalDetails": "The vulnerability exists in the implementation of the MCP (Model Context Protocol) server within PraisonAI, specifically within the MCPServer.startHttp() function located in src/praisonai-ts/src/mcp/server.ts. The root cause is a lack of host-level binding restrictions combined with a complete absence of authentication or authorization mechanisms for incoming HTTP POST requests.\nWhen MCPServer.startHttp() initializes the server, it fails to enforce access controls, effectively exposing the internal MCP command interface to the network. Every POST request directed at the server is forwarded directly to the handleRequest() function. Because this function performs no validation on the request source or identity, it processes all inbound payloads as legitimate commands.\nThe exploitation flow is as follows: 1. An attacker identifies the target PraisonAI instance, which is reachable via a network-accessible port. 2. The attacker crafts an HTTP POST request containing MCP-compliant payloads targeting methods such as 'tools/list', 'tools/call', 'resources/read', or 'prompts/get'. 3. The server receives the request and, due to the missing authentication middleware, executes the request handlers immediately. 4. The 'tools/call' method, if invoked, triggers the execution of registered handlers using the server-side process credentials. 5. This allows the attacker to run arbitrary tools, access restricted resources, or leverage server-side privileges to perform unauthorized actions or exfiltrate sensitive data.\nBecause the server lacks authentication, any entity capable of establishing a TCP connection to the exposed port can interface with the backend functionality. This results in a full bypass of intended security boundaries. The impact is significant: the attacker gains the ability to manipulate the system state by invoking tools that may interact with filesystems, external APIs, or other system resources, effectively achieving remote execution of system-defined capabilities. The session context defaults to the process privileges of the PraisonAI service, allowing for post-exploitation activities such as privilege escalation through internal tool manipulation or the retrieval of sensitive configuration data stored in memory or registered resources. The flaw persists across versions 1.5.0 through 1.7.2 until the initial remediation was implemented."
}