CVE-2026-55532
Received Received - Intake

MCP HTTP Stream Origin Validation Bypass in PraisonAI

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream _validate_origin uses request_origin.startswith(allowed), allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests without preflight and invoke tools/call without an API key, including file writes that persist agent instructions. This issue is fixed in version 4.6.58.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-55532
EUVD
EUVD-2026-65544

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
praisonai praisonai to 4.6.52 (exc)
praisonai praisonai 4.6.58

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CWE-346 The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55532 is a high-severity vulnerability in PraisonAI versions 4.6.52 and earlier. It involves an origin-validation bypass in the MCP HTTP server due to a flawed prefix match check using startswith. This allows attackers to bypass the localhost allowlist by using domains like localhost.attacker.com. The vulnerability enables unauthenticated CSRF attacks, letting attackers execute MCP tools without API keys or preflight requests.

Detection Guidance

Check if your PraisonAI version is below 4.6.58 by running praisonai --version. Inspect HTTP requests to the MCP server for origins starting with localhost or 127.0.0.1, especially those without preflight checks or API keys.

Impact Analysis

This vulnerability allows attackers to execute arbitrary MCP tools on your system without authentication. Attackers can write malicious files to the global rules directory, leading to persistent prompt injection. This means attacker instructions could be silently applied to every agent run, potentially exfiltrating sensitive data like SSH keys or API keys. The attack can be triggered by visiting a malicious webpage while running the local MCP server.

Compliance Impact

This vulnerability could lead to unauthorized access and data exfiltration, violating GDPR's data protection requirements and HIPAA's security rules. The persistent prompt injection may result in unauthorized processing of personal or health data, leading to compliance breaches and potential legal consequences.

Mitigation Strategies

Upgrade PraisonAI to version 4.6.58 or later immediately. Review and remove any unauthorized files in ~/.praison/rules. Implement strict origin validation and CSRF protections if custom configurations exist.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55532. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart