CVE-2026-55529
Received Received - Intake

PraisonAI MCP HTTP Stream Origin Validation Bypass

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream _validate_origin method accepts request_origin.startswith(allowed), so the attacker-controlled localhost.evil.example HTTP origin matches the localhost allowlist. Without an API key, a malicious webpage can submit tools/call requests to the local MCP server and execute exposed tools. This issue is fixed in version 4.6.58.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-55529
EUVD
EUVD-2026-65496

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
praisonai praisonai to 4.6.58 (inc)
mervinpraison praisonai to 4.6.58 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-346 The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an origin validation bypass in PraisonAI's MCP HTTP Stream transport. It allows a malicious webpage to execute tools on a local MCP server by tricking the server into accepting a fake localhost origin like localhost.evil.example. The server incorrectly validates origins by checking if they start with an allowed value, enabling unauthorized tool calls without an API key.

Detection Guidance

Check if PraisonAI MCP server is running locally by inspecting processes for praisonai or MCP server. Verify server version is below 4.6.58. Inspect network traffic for unexpected localhost connections or tool execution requests from web browsers.

Impact Analysis

An attacker could exploit this to run arbitrary tools on your local PraisonAI MCP server, potentially reading local files or modifying PraisonAI state. Since the server binds to 127.0.0.1, direct internet exposure is limited, but DNS-rebinding attacks could still enable exploitation if you visit a malicious webpage.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Unauthorized file access or state modifications may result in non-compliance with these regulations.

Mitigation Strategies

Upgrade PraisonAI to version 4.6.58 or later immediately. If upgrading is not possible, disable the MCP HTTP Stream transport or configure an API key to prevent unauthenticated access. Restrict localhost access to trusted applications only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55529. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart