CVE-2026-61427

Deferred Deferred - Pending Action

PraisonAI MCP HTTP-Stream Unauthenticated Access

Publication date: 2026-07-15

Last updated on: 2026-07-16

Assigner: VulnCheck

Description

PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the CLI --api-key option defaults to None, and the server only enforces Authorization/Bearer checks when an API key is configured. When an operator runs 'praisonai mcp serve --transport http-stream' without an API key, an unauthenticated client (no Authorization header, and no Origin header, which is also permitted) can initialize a session, enumerate the available tools (tools/list), and invoke tools (tools/call). Additionally, the dispatcher forwards tool-call arguments to handlers without validating them against the advertised inputSchema. The server binds to 127.0.0.1 by default, so remote exploitation requires the operator to bind to a network-accessible address (e.g., --host 0.0.0.0).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-16

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-03

NVD

CVE-2026-61427

EUVD

EUVD-2026-44638

Affected Vendors & Products

Vendor	Product	Version / Range
praisonai	praisonai	to 4.6.78 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

CVE-2026-61427 is an authentication bypass vulnerability in PraisonAI's MCP HTTP-stream transport. By default, the server does not require authentication unless an API key is explicitly set. This allows unauthenticated users to initialize sessions, list available tools, and invoke tools without providing any credentials. Additionally, the dispatcher forwards tool-call arguments without validating them against the advertised input schema.

Detection Guidance

Check if PraisonAI is running with the MCP HTTP-stream transport without authentication. Verify if the server is bound to 0.0.0.0 or a network-accessible address. Use tools like curl to test unauthenticated access to endpoints like /tools/list or /tools/call.

Impact Analysis

This vulnerability could allow attackers to abuse tool functions, leading to unauthorized data access, LLM-key or cost abuse, and potential misuse of system resources. Since tool arguments are not validated, attackers might exploit this to perform unintended actions or access sensitive data.

Compliance Impact

This vulnerability could lead to unauthorized data access or processing, violating GDPR's data protection principles and HIPAA's security requirements. Organizations using PraisonAI may face compliance violations due to insufficient access controls and input validation.

Mitigation Strategies

Upgrade PraisonAI to version 4.6.78 or later. Configure a strong API key and enforce authentication by setting --api-key. Avoid binding the server to 0.0.0.0 unless necessary. Validate tool-call arguments against inputSchema.

Hi! I’m here to help you understand CVE-2026-61427. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70