CVE-2026-0712: Missing Host/Origin validation in PraisonAI ToolsMCPServer SSE transport

Vulnerability Key Information Summary Vulnerability Overview Title: Legacy SSE Transport in ToolsMCPServer Accepts Attacker-Controlled Host/Origin and Exposes Registered Tools CVE ID: CVE-2026-0712 Severity: High (CVSS v3.1 score 8.3) Core Issue: When constructs the Starlette application, it fails to validate the and headers. This allows malicious websites to interact with the SSE server via DNS rebinding, enabling them to discover and invoke registered tools. Scope of Impact Affected Packages: - : - : Affected Components: - Main component: - CLI wrapper: Impact: An attacker can discover and invoke registered tools, thereby gaining access to local files, repositories, issues, local APIs, and internal services, resulting in impacts on confidentiality, integrity, and availability. Remediation 1. Align the security of the legacy SSE server with the current Streamable HTTP transport, or disable the legacy SSE server path. 2. Recommended changes: - Implement validation using predefined allow-origin and allow-host checks for the SSE and endpoints. - Reject invalid values with an HTTP 403 response before opening an SSE session or accepting POST messages. - Enable DNS rebinding mitigations for local and internal deployments (e.g., browser or web page ). - Require authentication for non-standard MCP HTTP transports. - Add , , and options. - Configure SDK transport-security settings when the legacy SSE is enabled. - Consider deprecating or disabling the server mode. - Add regression tests demonstrating that invalid and values are rejected on the SSE and endpoints. POC Code Technical Details Code

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-0712: Missing Host/Origin validation in PraisonAI ToolsMCPServer SSE transport

More from this source