CVE-2026-57112 json
PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
published 2026-06-18 4 mo ago modified 2026-09-16 53 d ago also EUVD-2026-78424 , GHSA-vmf9-xx9w-86wx , PYSEC-2026-3521 , PYSEC-2026-3534
- cvss
- 8.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 13%
- public exploits
- 0
- none known
Summary
PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, ToolsMCPServer.run_sse() in src/praisonai-agents/praisonaiagents/mcp/mcp_server.py mounts SseServerTransport on the legacy /sse and /messages/ endpoints without default Host, Origin, or authentication enforcement. A malicious website can use DNS rebinding against a reachable local or internal SSE server, supply attacker-controlled Host and Origin headers, enumerate registered tools, and invoke them with the server user's privileges. The Streamable HTTP transport rejects the same hostile Origin, which isolates the flaw to the legacy SSE wrapper. An initial remediation was released in praisonaiagents 1.6.59 and PraisonAI 4.6.59.
Patch / fix
- pypi praisonaiagents 1.6.59
- pypi praisonai 4.6.59
- praison praisonai 4.6.59
- praison praisonaiagents 1.6.59
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 53 d ago
Exploit prediction
0.22% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vmf9-xx9w-86wx referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.3 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 8.3 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H |
| OSV | 3.1 | 8.3 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | praisonaiagents | >=0.6.0, <1.6.59 |
1.6.59 |
| pypi | praisonai | >=3.10.0, <4.6.59 |
4.6.59 |
Affected products
- MervinPraison PraisonAI
- MervinPraison praisonaiagents
Classification
References
- github.com /MervinPraison/PraisonAI/commit/2adfe7e8323f6deec66925cf15a885b6238895e9
-
github.com
/MervinPraison/PraisonAI/security/advisories/GHSA-vmf9-xx9w-86wx
exploit, web
- github.com /MervinPraison/PraisonAI/releases/tag/v4.6.59
-
github.com
/MervinPraison/PraisonAI
package
-
pypi.org
/project/praisonai
package
-
github.com
/advisories/GHSA-vmf9-xx9w-86wx
advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-57112
advisory
-
pypi.org
/project/praisonaiagents
package
Sources
- CVE List CVE-2026-57112
- GitHub Advisory GHSA-vmf9-xx9w-86wx
- NVD CVE-2026-57112
- OSV PYSEC-2026-3521
- OSV PYSEC-2026-3534
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.