CVE-2026-57124
Deferred Deferred - Pending Action

Remote Code Execution in PraisonAI UI

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands bind to 0.0.0.0 by default, a reachable unauthenticated client can execute commands as the UI service account even when the MCP handshake later fails. This vulnerability is fixed in 4.6.59.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-57124
EUVD
EUVD-2026-77598

Affected Vendors & Products

Showing 14 associated CPEs
Vendor Product Version / Range
praisonai praisonai to 4.6.59 (exc)
praisonai praisonaiui to 4.6.59 (exc)
praisonai stdiomcpclient to 4.6.59 (exc)
mervinpraison praisonai to 4.6.59 (exc)
mervinpraison praisonai_ui to 4.6.59 (exc)
mervinpraison praisonai_ui_agents to 4.6.59 (exc)
mervinpraison praisonai_claw to 4.6.59 (exc)
praisonai praisonai_ui to 4.6.59 (exc)
praisonai praisonai_ui_agents to 4.6.59 (exc)
praisonai praisonai_claw to 4.6.59 (exc)
mervinpraison praisonai to 4.6.48 (inc)
mervinpraison praisonai_ui to 4.6.48 (inc)
mervinpraison praisonai_ui_agents to 4.6.48 (inc)
mervinpraison praisonai_claw to 4.6.48 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-57124 is a critical vulnerability in PraisonAI versions up to 4.6.48 where the UI MCP connect endpoint lacks authentication and improperly executes attacker-supplied OS commands. The issue stems from unauthenticated POST requests to /api/mcp/connect with command and args fields, which are passed directly to the MCP stdio client, allowing arbitrary local command execution as the PraisonAI UI service user.

The vulnerability combines missing authentication (CWE-306) with OS command injection (CWE-78), enabling remote attackers to execute commands, exfiltrate secrets, modify files, or disrupt services without credentials or user interaction.

Detection Guidance

Check if the PraisonAI UI service is running and exposing the /api/mcp/connect endpoint on port 0.0.0.0. Use curl to send a test POST request to the endpoint with arbitrary command and args values to verify if it executes commands without authentication. Example: curl -X POST http://<target-ip>:<port>/api/mcp/connect -H 'Content-Type: application/json' -d '{"command":"whoami","args":[]}'

Impact Analysis

An attacker could exploit this to execute arbitrary commands on the system running the PraisonAI UI service, potentially leading to data theft, system compromise, or service disruption. Since the endpoint binds to 0.0.0.0 by default, it is accessible remotely without authentication.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. The lack of authentication and command execution risks could result in data breaches or unauthorized modifications.

Mitigation Strategies

Upgrade PraisonAI to version 4.6.59 or later to address the vulnerability. If upgrading is not immediately possible, restrict network access to the /api/mcp/connect endpoint by binding it to localhost only or using a firewall. Disable the endpoint if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57124. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart