CVE-2026-55529: PraisonAI MCP origin-check bypass

CISO Take

PraisonAI's local MCP HTTP Stream server validates the request Origin header with a naive prefix match (startswith), so an attacker-controlled domain like localhost.evil.example passes the 'localhost' allowlist check meant to keep the server local-only. Because the endpoint requires no API key by default, any malicious webpage a developer or agent operator happens to visit can silently submit tools/call requests and execute whatever tools the local PraisonAI agent has exposed — file access, shell commands, or other integrations, depending on the agent's configuration. There's no EPSS score, no CISA KEV listing, and no public exploit or scanner template yet, and the CVSS 6.9 (AC:H, UI:R) reflects that the attacker needs the victim to browse to a crafted page while the vulnerable server is running unauthenticated — this is a drive-by/CSRF-style flaw, not a remote unauthenticated internet-facing bug. Only 1 downstream dependent is currently tracked, keeping blast radius contained for now, but given PraisonAI ships 153 other tracked CVEs its overall security posture is weak, so treat this as one more reason to lock the package down rather than a one-off. Action: upgrade to praisonai >=4.6.58 immediately, and regardless of version, require an API key on any MCP HTTP Stream endpoint and never rely on origin-string prefix matching for trust decisions.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Medium severity (CVSS 6.9) is appropriate: confidentiality impact is high and scope is changed (S:C) because a browser can pivot into a local process an internet page should never reach, but attack complexity is high and user interaction is required — the attacker needs the victim to visit a page hosted on a domain crafted to start with 'localhost' (e.g. via a subdomain trick) while the vulnerable MCP server is reachable and unauthenticated. No active exploitation (not in CISA KEV), no EPSS data, and no public PoC or Nuclei template exist yet, so near-term opportunistic exploitation risk is low. However, the underlying flaw class — trusting a substring/prefix match for an authentication-relevant check (CWE-346) combined with missing authentication (CWE-306) — is a common, easily-reproduced pattern once researchers or attackers start probing local MCP servers broadly, which are increasingly bundled with developer tooling and always-on agent runtimes.

How does the attack unfold?

Initial Access

Victim browses to an attacker-controlled webpage while PraisonAI's local MCP HTTP Stream server is running without an API key.

AML.T0078

Origin Validation Bypass

The page's script sends a request to the local MCP endpoint; the browser-set Origin header from a domain like localhost.evil.example passes the server's flawed startswith('localhost') check.

AML.T0107

Unauthorized Tool Invocation

The server accepts the forged-origin, unauthenticated request and processes a tools/call RPC, executing whichever tool the attacker specified.

AML.T0053

Impact

The attacker achieves unauthorized code execution or data access on the victim's machine via the invoked agent tool, consistent with the CVSS confidentiality-high, scope-changed impact.

Initial Access

Victim browses to an attacker-controlled webpage while PraisonAI's local MCP HTTP Stream server is running without an API key.

AML.T0078

Origin Validation Bypass

The page's script sends a request to the local MCP endpoint; the browser-set Origin header from a domain like localhost.evil.example passes the server's flawed startswith('localhost') check.

AML.T0107

Unauthorized Tool Invocation

The server accepts the forged-origin, unauthenticated request and processes a tools/call RPC, executing whichever tool the attacker specified.

AML.T0053

Impact

The attacker achieves unauthorized code execution or data access on the victim's machine via the invoked agent tool, consistent with the CVSS confidentiality-high, scope-changed impact.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	< 4.6.58	`4.6.58`
1 dependents61% patched~23d to patchFull package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

6.9 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 7% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACHigh

PRNone

UIRequired

SChanged

CHigh

ILow

ANone

What should I do?

1 step

1) Upgrade praisonai to 4.6.58 or later immediately. 2) Regardless of version, always configure an API key/auth token on the MCP HTTP Stream server rather than relying on origin allowlisting alone. 3) Bind the MCP server to 127.0.0.1 only and avoid exposing it to any network interface reachable by other hosts. 4) Where custom origin-validation code exists elsewhere in the stack, replace substring/prefix matching (startswith) with exact-match or parsed-hostname comparison against a strict allowlist. 5) Detection: review MCP server access logs for tools/call requests originating from unexpected Origin headers containing 'localhost' as a substring rather than the literal value, and for requests without an API key if one is configured.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassCode ExecutionAgentPluginAML.T0011- User Execution AML.T0053- AI Agent Tool Invocation AML.T0078- Drive-by Compromise AML.T0107- Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7-AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-55529?

PraisonAI's local MCP HTTP Stream server validates the request Origin header with a naive prefix match (startswith), so an attacker-controlled domain like localhost.evil.example passes the 'localhost' allowlist check meant to keep the server local-only. Because the endpoint requires no API key by default, any malicious webpage a developer or agent operator happens to visit can silently submit tools/call requests and execute whatever tools the local PraisonAI agent has exposed — file access, shell commands, or other integrations, depending on the agent's configuration. There's no EPSS score, no CISA KEV listing, and no public exploit or scanner template yet, and the CVSS 6.9 (AC:H, UI:R) reflects that the attacker needs the victim to browse to a crafted page while the vulnerable server is running unauthenticated — this is a drive-by/CSRF-style flaw, not a remote unauthenticated internet-facing bug. Only 1 downstream dependent is currently tracked, keeping blast radius contained for now, but given PraisonAI ships 153 other tracked CVEs its overall security posture is weak, so treat this as one more reason to lock the package down rather than a one-off. Action: upgrade to praisonai >=4.6.58 immediately, and regardless of version, require an API key on any MCP HTTP Stream endpoint and never rely on origin-string prefix matching for trust decisions.

Is CVE-2026-55529 actively exploited?

No confirmed active exploitation of CVE-2026-55529 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-55529?

1) Upgrade praisonai to 4.6.58 or later immediately. 2) Regardless of version, always configure an API key/auth token on the MCP HTTP Stream server rather than relying on origin allowlisting alone. 3) Bind the MCP server to 127.0.0.1 only and avoid exposing it to any network interface reachable by other hosts. 4) Where custom origin-validation code exists elsewhere in the stack, replace substring/prefix matching (`startswith`) with exact-match or parsed-hostname comparison against a strict allowlist. 5) Detection: review MCP server access logs for tools/call requests originating from unexpected Origin headers containing 'localhost' as a substring rather than the literal value, and for requests without an API key if one is configured.

What systems are affected by CVE-2026-55529?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers, local AI agent deployments.

What is the CVSS score for CVE-2026-55529?

CVE-2026-55529 has a CVSS v3.1 base score of 6.9 (MEDIUM). The EPSS exploitation probability is 0.18%.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP serverslocal AI agent deployments

MITRE ATLAS Techniques

AML.T0011User Execution

AML.T0053AI Agent Tool Invocation

AML.T0078Drive-by Compromise

AML.T0107Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream _validate_origin method accepts request_origin.startswith(allowed), so the attacker-controlled localhost.evil.example HTTP origin matches the localhost allowlist. Without an API key, a malicious webpage can submit tools/call requests to the local MCP server and execute exposed tools. This issue is fixed in version 4.6.58.

Exploitation Scenario

A developer runs a PraisonAI agent locally with the MCP HTTP Stream server enabled and no API key set, exposing tools/call functionality on localhost. The attacker registers a domain such as evil.example and hosts a page on the subdomain localhost.evil.example, then lures the developer to visit it (phishing link, malicious ad, compromised site). The victim's browser loads the page, whose JavaScript issues a fetch()/XHR request to http://127.0.0.1:<port>/mcp; the browser automatically sets the Origin header to 'http://localhost.evil.example', which PraisonAI's `_validate_origin` incorrectly accepts because it merely checks that the origin string starts with an allowed value ('localhost'). The forged-but-passing origin lets the request through without an API key, and the server processes a tools/call RPC, executing whichever tool the attacker specified — for example a shell or file-write tool — giving the attacker code execution or data access on the victim's machine, all without any visible prompt or consent dialog.

Weaknesses (CWE)

CWE-306Missing Authentication for Critical FunctionPrimary CWE-306Missing Authentication for Critical FunctionPrimary CWE-346Origin Validation ErrorPrimary CWE-346Origin Validation ErrorPrimary CWE-306Missing Authentication for Critical Function CWE-346Origin Validation Error

CWE-306 — Missing Authentication for Critical Function: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.