PrisonAI MCP Origin Validation Bypass Enables Unauthenticated CSRF and Persistent Prompt Injection (CVE-2026-55532)

Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PrisonAI MCP HTTP server, leading to persistent agent prompt injection Vulnerability Overview Vulnerability Type: Origin-validation bypass (startswith prefix match) Vulnerability Description: The PrisonAI MCP server exposes an HTTP-stream transport ( ), which binds to localhost and has no API key by default. Access control is implemented solely via Origin whitelisting for requests initiated by browsers, following the MCP 2025-11-25 security guidelines. The whitelist check uses prefix matching ( ), meaning any Origin string starting with or is accepted, such as . An attacker registers a domain; when a browser accesses a page on this domain, it sends a request with this Origin. The MCP server accepts and executes it without authentication. Since the request can be sent as a CORS "simple request" (Content-Type: text/plain), no preflight request is required. Furthermore, because tool calls do not require a session, a single forged request is sufficient to execute MCP tools. This is a Cross-Site Request Forgery (CSRF) attack targeting a developer's local agent runtime. The natural end-to-end payload is persistent prompt injection: the forged request creates a rules file, which the agent runtime loads and activates with "always," thereby injecting attacker-controlled instructions into every subsequent agent runtime execution. Impact Scope Affected Version: 4.6.52 Fixed Version: >= 4.6.58 Severity: 7.8 / 10 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Confidentiality: Low - Integrity: High - Availability: High CVE ID: CVE-2026-55532 Weaknesses: - CWE-346 - CWE-362 Remediation Recommendation: Use exact source comparison for scheme, host, and port instead of prefix matching. Treat missing Origins as invalid for state-changing methods rather than unconditionally accepting them, and validate headers to defend against DNS poisoning. Strongly consider enabling authentication by default for state-changing method requests (e.g., generate and print a token for the HTTP-stream transport when none is provided), and reject JSON-RPC request bodies for browser "simple requests" that do not have a Content-Type of , which bypass preflight checks. Finally, implement CSRF defenses for all state-changing tool call requests (requiring a non-simple Content-Type plus a custom header, which browser simple requests cannot set). POC Code

Goal Reached Thanks to every supporter — we hit 100%!

PrisonAI MCP Origin Validation Bypass Enables Unauthenticated CSRF and Persistent Prompt Injection (CVE-2026-55532)

More from this source