PraisonAI Unauthenticated Arbitrary File Read (CVE-2026-44336)

Vulnerability Overview Title: Unauthenticated arbitrary file read via PraisonAI MCP workflow.show, workflow.validate, deploy.validate Description: Vulnerability Type: Unauthenticated arbitrary file read CVE Number: CVE-2026-44336 GHSA Number: GHSA-9cr9-25g5-8prj Publication Date: May 19, 2023 Severity: High (CVSS v4 Base Score: 8.7/10) Summary: The original vulnerability description identified four vulnerable handlers: , , , and . These handlers accept files or file names as parameters without performing any validation. The fix (commit 68cc9427) only addressed , , and , while was left unmodified. Furthermore, two adjacent handlers, and , were not mentioned but also contain vulnerabilities. Impact: Any unauthenticated MCP tool caller can read arbitrary files on the host, such as , , , etc. Scope of Impact Affected Functions: - - : Returns the full content of any file readable by the host user. - : Reads any path; YAML parser error messages leak file existence and fragments of content. - : Follows the same pattern as . The defaults to , with input unconstrained by default. - - : Any JSON argument is passed as sent by the MCP client to invoke the handler. The original vulnerability report identifies this code path as the root cause. - - Default deployment exposure: - defaults to , which remains accessible from local processes or container neighbors. - defaults to , causing authentication checks to be skipped. - The same handlers are also accessible via the stdio transport. Other File Read Vulnerabilities: - : opens any host file and sends it to OpenAI Whisper. - : uploads any host file to OpenAI Files. - : opens any image and returns the OCR text. Remediation 1. Enforce in the Scheduler: - In , validate that arguments match the schema defined in the registry. - Code Example: 2. Per-Handler Restrictions: - Utilize the existing helper function (introduced in commit 68cc9427) to add restrictions. - Code Example: - Apply the same restrictions to and . - Apply restrictions to , defaulting to or an explicit allowlist. Proof of Concept (POC) Layout: How to Reproduce: - Terminal 1, Start Server: - Terminal 2, Run Attack: POC Code: - leaks : - leaks : - extracts credential files: Impact Confidentiality: High. Any file can be read by the MCP caller. Typical targets include host SSH keys, cloud credentials, API tokens, project files, , , browser cookie databases, and system password files. No Authentication Required: The default is , so authentication checks are skipped. No Operator Misconfiguration Required: This is the documented default behavior. The exploitation model for the original vulnerability still applies: An LLM connected via MCP, with context containing attacker-controlled web pages, documents, or emails, can store and execute the same tool calls to return responses. This requires the operator to click on something that goes beyond "Summarize this page." Recommended Fixes Enforce in the Scheduler: - Validate that arguments match the schema defined in the registry. Per-Handler Restrictions: - Use the existing helper function to add restrictions.

Goal Reached Thanks to every supporter — we hit 100%!

PraisonAI Unauthenticated Arbitrary File Read (CVE-2026-44336)

More from this source