CVE-2026-57139
Received Received - Intake

PraisonAI MCPServer Unauthenticated HTTP Request Handling Vulnerability

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
PraisonAI is a multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp() in src/praisonai-ts/src/mcp/server.ts binds without a host restriction and forwards every HTTP POST request to handleRequest() without authentication or authorization. Any network client that can reach the port can call tools/list, tools/call, resources/read, or prompts/get, causing registered handlers to run with server-side credentials and process privileges or disclose registered data. An initial remediation was released in version 1.7.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-57139
EUVD
EUVD-2026-78393

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
praisonai praisonai From 1.5.0 (inc) to 1.7.2 (inc)
mervinpraison praisonai From 1.5.0 (inc) to 1.7.2 (exc)
mervinpraison praisonai 1.7.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-1188 The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects PraisonAI versions 1.5.0 to 1.7.1. The MCPServer.startHttp() function in the TypeScript component binds to all network interfaces without host restrictions and forwards HTTP POST requests to handleRequest() without requiring authentication or authorization. This allows any network client to access sensitive MCP methods like tools/call, resources/read, and prompts/get.

Detection Guidance

Check if the PraisonAI MCPServer is running on any system by inspecting network services. Look for open ports, particularly those listening on all interfaces (0.0.0.0 or ::). Use commands like 'netstat -tulnp' or 'ss -tulnp' to identify listening ports. Verify if the server responds to HTTP POST requests on endpoints like /tools/call, /tools/list, /resources/read, or /prompts/get without authentication.

Impact Analysis

Unauthenticated attackers can invoke registered tools, potentially leading to unauthorized actions such as file system operations, API calls, or code execution. They may also access or disclose registered data, including server-side credentials and processed privileges.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection principles and HIPAA's security requirements for safeguarding sensitive information. Compliance may be compromised due to potential breaches of confidentiality and integrity.

Mitigation Strategies

Upgrade PraisonAI to version 1.7.2 or later immediately. If upgrading is not possible, restrict network access to the MCPServer by binding it to localhost only or using a firewall to block external access. Ensure no sensitive tools or resources are registered in the MCPServer until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57139. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart