CVE-2026-57123: PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in

Should you act?

Critical and remotely reachable

No known exploitation yet, but it is network-reachable without credentials. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
• EPSS 0.9%, percentile 59: FIRST’s model estimates a 0.9% chance of exploitation activity in the next 30 days, higher than 59% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
• Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
• Only applies if your dependency tree includes praisonaiagents (PyPI) < 1.6.59, fixed in 1.6.59. Check your lockfile, including transitive dependencies.

What it is

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.runsse and launchtoolsmcpserver bind to 0.0.0.0 and create /sse and /messages/ routes without invoking the available SecurityConfig authentication, origin-validation, or DNS-rebinding controls. Any reachable client can list and invoke registered tools, and a browser can target a local instance through DNS rebinding, with impact determined by the registered file, shell, and code-execution tools. This vulnerability is fixed in praisonaiagents 1.6.59.

From the GitHub advisory

The MCP SSE server started via ToolsMCPServer.runsse() / launchtoolsmcpserver(transport="sse") binds to 0.0.0.0 by default and builds its Starlette application with no authentication middleware and no Origin-header validation. The module mcp/mcpsecurity.py provides exactly the needed controls (origin validation, DNS-rebinding detection, auth-header enforcement, a SecurityConfig), but none of these functions are ever called by any transport — they are dead code. Any host that can reach the port can list and invoke every registered tool with no credentials, and a victim's browser can drive the same calls against a localhost instance via DNS rebinding.

Affected code: src/praisonai-agents/praisonaiagents/mcp/mcpserver.py - runsse defaults host to all interfaces (line 245) and builds the app with only debug and routes - no middleware= and no per-route auth/origin gate (lines ~271-289): app = Starlette(debug=self.debug, routes=[ Route(ssepath, endpoint=handlesse), # "/sse" Mount(messagespath, app=ssetransport.handlepostmessage), # "/messages/" ]) uvicorn.run(app, host=host, port=port) - launchtoolsmcpserver also defaults host="0.0.0.0" (line 301).

src/praisonai-agents/praisonaiagents/mcp/mcpsecurity.py defines but the transports never call: - isvalidorigin (line 30), ispotentialdnsrebinding (line 110), validateauthheader (line 167), SecurityConfig.isoriginallowed (line 236). These symbols are referenced only inside mcpsecurity.py and the init re-export. (mcpwebsocket.py's auth references are CLIENT-side, not server validation.)

Impact: launchtoolsmcpserver(transport="sse") is the documented path for exposing tools over MCP. With the defaults above it is an unauthenticated, network-reachable tool-execution endpoint. Blast radius equals the capabilities of the registered tools; with file/shell/code-exec tools this is RCE. With no Origin check, a malicious page the victim merely visits can rebind its hostname to 127.0.0.1 and issue the JSON-RPC calls cross-origin against a developer's local server.

Proof of concept: Static proof (AST analysis of unmodified source): Check 1 - runsse(host='0.0.0.0'); launchtoolsmcpserver(host='0.0.0.0') -> EXPOSED Check 2 - Starlette(...) kwargs: ['debug','routes'] -> NO middleware= (no auth/origin gate) …

Weakness type: CWE-306, CWE-350, CWE-1327.

Product: praisonaiagents (PyPI) · Assigned by: GitHub_M · Published: 2026-09-14

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Privileges required: none (no login)
• User interaction: none
• Scope: unchanged

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
• FIRST EPSS (model of 2026-10-21): 0.90% probability of exploitation activity in the next 30 days; percentile 59.

Timeline

• 2026-06-18 — GitHub-reviewed advisory GHSA-x227-pf99-vffg published (critical)
• 2026-09-14 — CVE record last updated
• 2026-09-14 — CVE record published by GitHub_M

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-x227-pf99-vffg github.com
2. CVE.org record CVE-2026-57123 cve.org
3. NVD entry CVE-2026-57123 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com
2. github.com github.com
3. github.com github.com

Critical PyPI advisories · Today’s Security Digest