CVE-2026-57112 Details
Description
PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, ToolsMCPServer.run_sse() in src/praisonai-agents/praisonaiagents/mcp/mcp_server.py mounts SseServerTransport on the legacy /sse and /messages/ endpoints without default Host, Origin, or authentication enforcement. A malicious website can use DNS rebinding against a reachable local or internal SSE server, supply attacker-controlled Host and Origin headers, enumerate registered tools, and invoke them with the server user's privileges. The Streamable HTTP transport rejects the same hostile Origin, which isolates the flaw to the legacy SSE wrapper. An initial remediation was released in praisonaiagents 1.6.59 and PraisonAI 4.6.59.
A vulnerability exists in the Server-Sent Events (SSE) transport of PraisonAI's MCP server tools, specifically in PraisonAI Agents versions 0.6.0 prior to 1.6.59 and PraisonAI versions 3.10.0 prior to 4.6.59. The issue arises because the SSE server, when run without proper security checks, allows a malicious website to send requests that include attacker-controlled Host and Origin headers. This can be exploited to interact with the SSE server as the local user, potentially leading to unauthorized access to sensitive tools and resources.
Users can update to PraisonAI Agents version 1.6.59 or PraisonAI version 4.6.59, both of which include the necessary security enhancements. After updating, it's recommended to review and adjust the server configuration to ensure proper origin and host validation is in place when using the SSE transport.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vmf9-xx9w-86wx | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/MervinPraison/PraisonAI/commit/2adfe7e8323f6deec66925cf15a885b6238895e9 | [email protected] | Source CodeVendor |
| https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.59 | [email protected] | Release NotesVendor |
| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vmf9-xx9w-86wx | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-346 | Origin Validation Error | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MervinPraison/PraisonAI | >= 3.10.0, <= 4.6.58 (semver) |
CPE
Remediation
| |
| MervinPraison/praisonaiagents | >= 0.6.0, <= 1.6.58 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | CVE Modified | CISA-ADP |
| Sep 15, 2026 | New CVE Received | [email protected] |