CVE-2026-57123 Details
Description
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.run_sse and launch_tools_mcp_server bind to 0.0.0.0 and create /sse and /messages/ routes without invoking the available SecurityConfig authentication, origin-validation, or DNS-rebinding controls. Any reachable client can list and invoke registered tools, and a browser can target a local instance through DNS rebinding, with impact determined by the registered file, shell, and code-execution tools. This vulnerability is fixed in praisonaiagents 1.6.59.
A vulnerability in the ToolsMCPServer component of PraisonAI, prior to version 1.6.59, allows for unauthenticated execution of registered tools. The issue arises because the server binds to all network interfaces and creates routes for server-sent events and messages without proper authentication or origin validation. This oversight enables any reachable client to list and invoke tools, and allows a browser to exploit a local instance through DNS rebinding, potentially leading to remote code execution, depending on the tools registered. The vulnerability exists in the 'praisonaiagents' package, versions through 1.6.52.
Users can upgrade to PraisonAI version 1.6.59 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1327 | Binding to an Unrestricted IP Address | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-350 | Reliance on Reverse DNS Resolution for a Security-Critical Action | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MervinPraison/PraisonAI | <= 1.6.52 (semver) |
CPE
Remediation
| |
| MervinPraison/PraisonAI | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | New CVE Received | [email protected] |