CVE-2026-57112— PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
Quick assessment
Affected
MervinPraison PraisonAI
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PraisonAI 是一个多智能体（multi-agent）团队协作系统。在 praisonaiagents 0.6.0 至 1.6.59 以及 PraisonAI 3.10.0 至 4.6.59 版本中，位于 中的 方法在传统的 和 端点上挂载了 ，但并未强制要求默认的 Host、Origin 或身份验证机制。 这使得恶意网站可以利用 DNS 重绑定（DNS rebinding）技术，针对可访问的本地或内部 SSE 服务器发起攻击，并提供由攻击者控制的 Host 和 Origin 请求头，从而枚举已注册的工具，并
Possible ATT&CK Techniques 1 AI
T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-57112
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
Source: CVE Program / CVE List V5
Vulnerability Description
PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, ToolsMCPServer.run_sse() in src/praisonai-agents/praisonaiagents/mcp/mcp_server.py mounts SseServerTransport on the legacy /sse and /messages/ endpoints without default Host, Origin, or authentication enforcement. A malicious website can use DNS rebinding against a reachable local or internal SSE server, supply attacker-controlled Host and Origin headers, enumerate registered tools, and invoke them with the server user's privileges. The Streamable HTTP transport rejects the same hostile Origin, which isolates the flaw to the legacy SSE wrapper. An initial remediation was released in praisonaiagents 1.6.59 and PraisonAI 4.6.59.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MervinPraison | PraisonAI | >= 3.10.0, < 4.6.59 | - |
|
| MervinPraison | praisonaiagents | >= 0.6.0, < 1.6.59 | - |
|
II. Public POCs for CVE-2026-57112
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-57112
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-57112 (1)
Vendor Advisories for CVE-2026-57112 (1)
Vendor Pages for CVE-2026-57112 (1)
-
🔗 Release PraisonAI v4.6.59 · MervinPraison/PraisonAI · GitHub x_refsource_MISC
Same Patch Batch · MervinPraison · 2026-09-15 · 12 CVEs total
| CVE-2026-57138 | 9.9 CRITICAL | PraisonAI codeMode sandbox escape via Function constructor |
| CVE-2026-57139 | 9.8 CRITICAL | PraisonAI MCPServer exposes unauthenticated HTTP tools/call |
| CVE-2026-57141 | 9.8 CRITICAL | PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool |
| CVE-2026-57147 | 9.8 CRITICAL | praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forger |
| CVE-2026-57148 | 9.8 CRITICAL | praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (def |
| CVE-2026-57140 | 9.4 CRITICAL | PraisonAI AgentOS exposes unauthenticated agent listing and invocation |
| CVE-2026-57133 | 8.8 HIGH | PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining |
| CVE-2026-57136 | 8.8 HIGH | PraisonAI SandboxExecutor allowedCommands bypass via shell chaining |
| CVE-2026-57137 | 8.8 HIGH | PraisonAI AgentLoop onToolCall approval runs after tool execution |
| CVE-2026-57134 | 8.2 HIGH | PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials witho |
| CVE-2026-57135 | 7.6 HIGH | PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network cli |
IV. Related Vulnerabilities
Same product: PraisonAI
-
CVE-2026-57147
praisonai-platform: default JWT signing secret 'dev-secret-c -
CVE-2026-57148
praisonai-platform 0.1.4 still boots on the hardcoded JWT se -
CVE-2026-57140
PraisonAI AgentOS exposes unauthenticated agent listing and -
CVE-2026-57139
PraisonAI MCPServer exposes unauthenticated HTTP tools/call -
CVE-2026-57133
PraisonAI utility shell safe-command wrapper allowlist bypas
Same vendor: MervinPraison
-
CVE-2026-57147
praisonai-platform: default JWT signing secret 'dev-secret-c -
CVE-2026-57148
praisonai-platform 0.1.4 still boots on the hardcoded JWT se -
CVE-2026-57140
PraisonAI AgentOS exposes unauthenticated agent listing and -
CVE-2026-57139
PraisonAI MCPServer exposes unauthenticated HTTP tools/call -
CVE-2026-57133
PraisonAI utility shell safe-command wrapper allowlist bypas
Same weakness: CWE-306
-
CVE-2026-91996
lamp-cloud through 5.10.0 Missing Authentication for JVM Pro -
CVE-2026-57140
PraisonAI AgentOS exposes unauthenticated agent listing and -
CVE-2026-57139
PraisonAI MCPServer exposes unauthenticated HTTP tools/call -
CVE-2026-91002
stamparm maltrail Blacklist Endpoint httpd.py _blacklist mis -
CVE-2026-90896
Missing authentication in Ecommerce Template checkout sessio
V. Comments for CVE-2026-57112
No comments yet