CVE-2026-55532 json
PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server
published 2026-08-25 2 mo ago modified 2026-09-10 1 mo ago also EUVD-2026-65544 , GHSA-pvph-5j39-v8qc , PYSEC-2026-3892
- cvss
- 7.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 9%
- public exploits
- 0
- none known
Summary
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream _validate_origin uses request_origin.startswith(allowed), allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests without preflight and invoke tools/call without an API key, including file writes that persist agent instructions. This issue is fixed in version 4.6.58.
Patch / fix
- pypi praisonai 4.6.58
- praison praisonai 4.6.58
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.20% chance of exploitation in the next 30 days, higher than 9% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L |
| GitHub | 3.1 | 7.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L |
| OSV | 3.1 | 7.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | praisonai | <4.6.58 |
4.6.58 |
Affected products
- MervinPraison PraisonAI
Classification
References
-
github.com
/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1
web
-
github.com
/MervinPraison/PraisonAI/security/advisories/GHSA-pvph-5j39-v8qc
web
-
github.com
/MervinPraison/PraisonAI/releases/tag/v4.6.58
web
-
github.com
/MervinPraison/PraisonAI
package
-
pypi.org
/project/praisonai
package
-
github.com
/advisories/GHSA-pvph-5j39-v8qc
advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-55532
advisory
Sources
- CVE List CVE-2026-55532
- GitHub Advisory GHSA-pvph-5j39-v8qc
- NVD CVE-2026-55532
- OSV PYSEC-2026-3892
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.