CVE-2026-55532: PraisonAI Origin bypass CSRF enables

Q: Is CVE-2026-55532 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-55532, increasing the risk of exploitation.

Q: How to fix CVE-2026-55532?

Patch PraisonAI to 4.6.58 or later, which fixes the Origin validation logic. Until patched, do not run `praisonai mcp serve --transport http-stream` without explicitly setting `--api-key`; prefer binding only to loopback and avoid leaving the server running while browsing untrusted sites. As defense in depth, treat the Origin allowlist fix pattern generally — replace any `startswith()`/prefix-based origin checks with exact scheme+host+port comparison via a URL parser, reject browser "simple requests" (non-`application/json` Content-Type) at the JSON-RPC dispatcher, and require a session token or custom header that a cross-site request cannot set. For detection, audit `~/.praison/rules` (and analogous agent-runtime config/rules directories) for unexpected `.md`/`.mdc`/`.txt` files with `activation: always`, and monitor for unauthenticated POSTs to local MCP ports with spoofed `localhost*`-prefixed Origin headers in proxy/host firewall logs.

Q: What systems are affected by CVE-2026-55532?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers / tool integrations, local developer agent runtimes.

Q: What is the CVSS score for CVE-2026-55532?

CVE-2026-55532 has a CVSS v3.1 base score of 7.6 (HIGH). The EPSS exploitation probability is 0.20%.

CISO Take

The PraisonAI MCP server's local HTTP-stream transport authenticates requests solely via an Origin header allowlist, and that check uses a naive prefix match (startswith) instead of exact-origin comparison, so any domain beginning with "localhost" (e.g. localhost.attacker.com) is accepted from a browser. Because the forged request can be sent as a CORS "simple request" with no preflight and no session token, a single drive-by visit to a malicious webpage lets an attacker blind-CSRF the victim's local agent runtime and invoke unauthenticated tools — most seriously, writing a rule file with activation "always" that the agent loads on every subsequent run, giving persistent prompt injection capable of instructing the agent to exfiltrate SSH keys and API credentials. This is rated high severity (CVSS 7.6) with confidentiality and integrity impact, though EPSS data is not yet available, it is not in CISA KEV, and no public exploit or Nuclei template exists — exploitation requires user interaction (visiting a page) but no direct network access, and the package shows only 1 tracked downstream dependent and a package risk score of 0/100, indicating limited current install-base visibility rather than low severity. Any team running PraisonAI's MCP server locally (developer machines, agentic CI runners) should patch to 4.6.58 immediately, and until then should not run `praisonai mcp serve --transport http-stream` without an explicit `--api-key`, should audit `~/.praison/rules` for unexpected files, and should treat browser-originated Origin headers as untrusted for any local agent tooling more broadly.

Sources:NVDGitHub AdvisoryCISA KEVATLAS

What is the risk?

High risk despite requiring user interaction: the attack is a classic drive-by (visit any webpage, no direct network access needed) against a service developers commonly leave running unauthenticated on localhost for convenience. The Origin allowlist logic looks correct at a glance (it does reject a plain http://attacker.com origin) which increases the chance it ships unnoticed in similar MCP/local-agent implementations. Exploitability is low-effort once known — a single unauthenticated HTTP POST with a crafted Origin header and text/plain body — and the demonstrated impact (persistent, always-on prompt injection into a developer's future agent invocations) is severe: it can lead to silent, ongoing credential and secret exfiltration. Mitigating factors are the current CVSS AC:L/UI:R combination, absence from CISA KEV, no observed in-the-wild exploitation, and no public scanner template, so this looks like an unweaponized-but-easily-weaponizable disclosure rather than an active campaign.

How does the attack unfold?

Initial Access

Victim developer visits an attacker-hosted webpage at a domain like localhost.attacker.com while a local PraisonAI MCP server is running unauthenticated.

AML.T0078

Origin Bypass / CSRF

The page's script sends a cross-site JSON-RPC POST with Content-Type: text/plain (no preflight) and a spoofed Origin that passes the prefix-match allowlist check.

AML.T0053

Tool Invocation & Persistence

The unauthenticated praisonai.rules.create tool writes an attacker-controlled rule file into ~/.praison/rules with activation "always".

AML.T0081

Impact: Persistent Prompt Injection

The agent runtime's RulesManager loads the planted rule on every future invocation, silently injecting instructions to exfiltrate SSH keys and API credentials.

AML.T0051.001

Initial Access

Victim developer visits an attacker-hosted webpage at a domain like localhost.attacker.com while a local PraisonAI MCP server is running unauthenticated.

AML.T0078

Origin Bypass / CSRF

The page's script sends a cross-site JSON-RPC POST with Content-Type: text/plain (no preflight) and a spoofed Origin that passes the prefix-match allowlist check.

AML.T0053

Tool Invocation & Persistence

The unauthenticated praisonai.rules.create tool writes an attacker-controlled rule file into ~/.praison/rules with activation "always".

AML.T0081

Impact: Persistent Prompt Injection

The agent runtime's RulesManager loads the planted rule on every future invocation, silently injecting instructions to exfiltrate SSH keys and API credentials.

AML.T0051.001

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	< 4.6.58	`4.6.58`
1 dependents61% patched~23d to patchFull package profile →
PraisonAI Agents	pip	—	No patch
20 dependents63% patched~21d to patchFull package profile →

How severe is it?

CVSS 3.1

7.6 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 10% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CLow

IHigh

ALow

What should I do?

1 step

Patch PraisonAI to 4.6.58 or later, which fixes the Origin validation logic. Until patched, do not run praisonai mcp serve --transport http-stream without explicitly setting --api-key; prefer binding only to loopback and avoid leaving the server running while browsing untrusted sites. As defense in depth, treat the Origin allowlist fix pattern generally — replace any startswith()/prefix-based origin checks with exact scheme+host+port comparison via a URL parser, reject browser "simple requests" (non-application/json Content-Type) at the JSON-RPC dispatcher, and require a session token or custom header that a cross-site request cannot set. For detection, audit ~/.praison/rules (and analogous agent-runtime config/rules directories) for unexpected .md/.mdc/.txt files with activation: always, and monitor for unauthenticated POSTs to local MCP ports with spoofed localhost*-prefixed Origin headers in proxy/host firewall logs.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassPrompt InjectionAgentPluginAML.T0051.001- Indirect AML.T0053- AI Agent Tool Invocation AML.T0078- Drive-by Compromise AML.T0080.000- Memory AML.T0081- Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system security controls

NIST AI RMF

MANAGE-4.1-AI system incidents are monitored, and responses to unanticipated events are documented and communicated

OWASP LLM Top 10

LLM01:2025-Prompt Injection

Frequently Asked Questions

What is CVE-2026-55532?

The PraisonAI MCP server's local HTTP-stream transport authenticates requests solely via an Origin header allowlist, and that check uses a naive prefix match (startswith) instead of exact-origin comparison, so any domain beginning with "localhost" (e.g. localhost.attacker.com) is accepted from a browser. Because the forged request can be sent as a CORS "simple request" with no preflight and no session token, a single drive-by visit to a malicious webpage lets an attacker blind-CSRF the victim's local agent runtime and invoke unauthenticated tools — most seriously, writing a rule file with activation "always" that the agent loads on every subsequent run, giving persistent prompt injection capable of instructing the agent to exfiltrate SSH keys and API credentials. This is rated high severity (CVSS 7.6) with confidentiality and integrity impact, though EPSS data is not yet available, it is not in CISA KEV, and no public exploit or Nuclei template exists — exploitation requires user interaction (visiting a page) but no direct network access, and the package shows only 1 tracked downstream dependent and a package risk score of 0/100, indicating limited current install-base visibility rather than low severity. Any team running PraisonAI's MCP server locally (developer machines, agentic CI runners) should patch to 4.6.58 immediately, and until then should not run `praisonai mcp serve --transport http-stream` without an explicit `--api-key`, should audit `~/.praison/rules` for unexpected files, and should treat browser-originated Origin headers as untrusted for any local agent tooling more broadly.

Is CVE-2026-55532 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-55532, increasing the risk of exploitation.

How to fix CVE-2026-55532?

Patch PraisonAI to 4.6.58 or later, which fixes the Origin validation logic. Until patched, do not run `praisonai mcp serve --transport http-stream` without explicitly setting `--api-key`; prefer binding only to loopback and avoid leaving the server running while browsing untrusted sites. As defense in depth, treat the Origin allowlist fix pattern generally — replace any `startswith()`/prefix-based origin checks with exact scheme+host+port comparison via a URL parser, reject browser "simple requests" (non-`application/json` Content-Type) at the JSON-RPC dispatcher, and require a session token or custom header that a cross-site request cannot set. For detection, audit `~/.praison/rules` (and analogous agent-runtime config/rules directories) for unexpected `.md`/`.mdc`/`.txt` files with `activation: always`, and monitor for unauthenticated POSTs to local MCP ports with spoofed `localhost*`-prefixed Origin headers in proxy/host firewall logs.

What systems are affected by CVE-2026-55532?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers / tool integrations, local developer agent runtimes.

What is the CVSS score for CVE-2026-55532?

CVE-2026-55532 has a CVSS v3.1 base score of 7.6 (HIGH). The EPSS exploitation probability is 0.20%.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP servers / tool integrationslocal developer agent runtimes

MITRE ATLAS Techniques

AML.T0051.001Indirect

AML.T0053AI Agent Tool Invocation

AML.T0078Drive-by Compromise

AML.T0080.000Memory

AML.T0081Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-4.1

OWASP LLM Top 10: LLM01:2025

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream _validate_origin uses request_origin.startswith(allowed), allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests without preflight and invoke tools/call without an API key, including file writes that persist agent instructions. This issue is fixed in version 4.6.58.

Exploitation Scenario

A developer starts `praisonai mcp serve --transport http-stream --host 127.0.0.1 --port 8080` for local agent development, with no API key configured. Later that day they browse to an unrelated site that is actually attacker-controlled and hosted at `http://localhost.attacker.com` (a domain the attacker registered specifically to pass the prefix-match Origin check). The page's JavaScript silently fires a `fetch()` POST to `http://127.0.0.1:8080/mcp` with `Content-Type: text/plain` (avoiding CORS preflight) and a JSON-RPC body invoking `praisonai.rules.create`, writing `~/.praison/rules/evil.md` with instructions to append SSH keys and API tokens to the agent's output. The developer never sees this happen — the response isn't readable cross-origin. The next time they invoke their PraisonAI agent for any task, `RulesManager` loads `evil.md` with "always" activation, and the injected instruction silently exfiltrates their credentials in the agent's output or via a subsequent tool call, repeating on every future agent run until the file is discovered and removed.