CVE-2026-57112
PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, ToolsMCPServer.run_sse() in src/praisonai-agents/praisonaiagents/mcp/mcp_server.py mounts SseServerTransport on the legacy /sse and /messages/ endpoints without default Host, Origin, or authentication enforcement. A malicious website can use DNS rebinding against a reachable local or internal SSE server, supply attacker-controlled Host and Origin headers, enumerate registered tools, and invoke them with the server user's privileges. The Streamable HTTP transport rejects the same hostile Origin, which isolates the flaw to the legacy SSE wrapper. An initial remediation was released in praisonaiagents 1.6.59 and PraisonAI 4.6.59.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | High8.3 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H |
| NVDNVD · Deferred | 3.1 | High8.3 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.22% · top 87% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.3.
Weakness
Affected products
- affected >= 3.10.0, < 4.6.59
MervinPraison · praisonaiagents
- affected >= 0.6.0, < 1.6.59
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- PyPIpraisonaiGHSA-vmf9-xx9w-86wx (opens in a new tab)
- PyPIpraisonaiagentsGHSA-vmf9-xx9w-86wx (opens in a new tab)
References (3)
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vmf9-xx9w-86wx (opens in a new tab)x_refsource_CONFIRMexploit
- https://github.com/MervinPraison/PraisonAI/commit/2adfe7e8323f6deec66925cf15a885b6238895e9 (opens in a new tab)x_refsource_MISC
- https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.59 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-vmf9-xx9w-86wx (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-57112)Record last updated .