CVE-2026-57123: PraisonAI Agents unauthenticated

CISO Take

PraisonAI's agent tool server (ToolsMCPServer) binds to 0.0.0.0 and exposes its /sse and /messages/ routes without ever invoking the framework's own SecurityConfig authentication, origin-validation, or DNS-rebinding protections, so any network-reachable client — or even a browser via DNS rebinding against a 'localhost-only' instance — can list and invoke every registered agent tool. This is a network-exploitable, no-privilege, no-user-interaction flaw (CVSS 9.8) in an agent framework where tools commonly include shell execution, file access, and code interpreters, meaning the practical blast radius is full host compromise rather than a contained data leak. There is no EPSS score, CISA KEV listing, public exploit, or Nuclei template yet, so this looks unweaponized today, but the flaw is trivial to find (unauthenticated endpoints, no auth bypass needed) and PraisonAI is an actively used multi-agent framework, making rapid exploitation plausible once scanners catch up. Patch to praisonaiagents 1.6.59 immediately; until then, do not expose ToolsMCPServer beyond 127.0.0.1, front it with an authenticating reverse proxy that validates Origin/Host headers, and audit which tools (especially shell/file/code-exec) are registered on any instance that has ever been network-reachable.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Critical and trivially exploitable: CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) reflects that no credentials, prior access, or user interaction are needed — an attacker only needs network reachability to the SSE endpoint, or a victim visiting a malicious webpage if the DNS-rebinding path is used against a 'local-only' deployment. Actual severity is tool-dependent: instances exposing only read-only or low-risk tools face information disclosure and tool-abuse risk, while instances registering shell, file-write, or code-execution tools (common in agentic setups) face full remote code execution. Exposure is elevated because 0.0.0.0 binding is the vulnerable default, meaning any deployment that didn't explicitly restrict network access or add its own auth layer in front is affected.

How does the attack unfold?

Discovery

Attacker scans for exposed ToolsMCPServer instances on 0.0.0.0, or lures a victim to a page performing DNS rebinding to reach a 'localhost-only' instance.

AML.T0006

Unauthenticated Connection

The /sse and /messages/ routes accept the connection with no SecurityConfig authentication or origin validation enforced.

AML.T0049

Tool Discovery and Invocation

Attacker lists the agent's registered tools and invokes them directly without authorization.

AML.T0053

Impact

If shell, file, or code-execution tools are registered, the attacker achieves remote code execution or data theft on the host running the agent.

AML.T0112.000

Discovery

Attacker scans for exposed ToolsMCPServer instances on 0.0.0.0, or lures a victim to a page performing DNS rebinding to reach a 'localhost-only' instance.

AML.T0006

Unauthenticated Connection

The /sse and /messages/ routes accept the connection with no SecurityConfig authentication or origin validation enforced.

AML.T0049

Tool Discovery and Invocation

Attacker lists the agent's registered tools and invokes them directly without authorization.

AML.T0053

Impact

If shell, file, or code-execution tools are registered, the attacker achieves remote code execution or data theft on the host running the agent.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI Agents	pip	—	No patch
20 dependents 59% patched ~6d to patch Full package profile →

Do you use PraisonAI Agents? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 40% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade to praisonaiagents 1.6.59 or later immediately — the fix adds the missing SecurityConfig authentication, origin validation, and DNS-rebinding protections to the /sse and /messages/ routes. If immediate patching isn't possible: bind the tool server to 127.0.0.1 instead of 0.0.0.0, place it behind a reverse proxy that enforces authentication and strict Origin/Host header validation, restrict network access via firewall/security group rules to only trusted MCP clients, and temporarily de-register or disable shell, file-write, and code-execution tools on any exposed instance. For detection, review access/proxy logs for unexpected connections to /sse or /messages/ from unfamiliar IPs or browser-origin Referer/Origin headers, and audit which tools are currently registered on all running ToolsMCPServer instances to gauge actual exposure.

How is it classified?

Auth Bypass Code Execution Agent Framework AML.T0006 - Active Scanning AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0084.001 - Tool Definitions

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2 - AI system security controls

NIST AI RMF

MANAGE-1.3 - Risk Response and Treatment

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-57123?

PraisonAI's agent tool server (ToolsMCPServer) binds to 0.0.0.0 and exposes its /sse and /messages/ routes without ever invoking the framework's own SecurityConfig authentication, origin-validation, or DNS-rebinding protections, so any network-reachable client — or even a browser via DNS rebinding against a 'localhost-only' instance — can list and invoke every registered agent tool. This is a network-exploitable, no-privilege, no-user-interaction flaw (CVSS 9.8) in an agent framework where tools commonly include shell execution, file access, and code interpreters, meaning the practical blast radius is full host compromise rather than a contained data leak. There is no EPSS score, CISA KEV listing, public exploit, or Nuclei template yet, so this looks unweaponized today, but the flaw is trivial to find (unauthenticated endpoints, no auth bypass needed) and PraisonAI is an actively used multi-agent framework, making rapid exploitation plausible once scanners catch up. Patch to praisonaiagents 1.6.59 immediately; until then, do not expose ToolsMCPServer beyond 127.0.0.1, front it with an authenticating reverse proxy that validates Origin/Host headers, and audit which tools (especially shell/file/code-exec) are registered on any instance that has ever been network-reachable.

Is CVE-2026-57123 actively exploited?

No confirmed active exploitation of CVE-2026-57123 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-57123?

Upgrade to praisonaiagents 1.6.59 or later immediately — the fix adds the missing SecurityConfig authentication, origin validation, and DNS-rebinding protections to the /sse and /messages/ routes. If immediate patching isn't possible: bind the tool server to 127.0.0.1 instead of 0.0.0.0, place it behind a reverse proxy that enforces authentication and strict Origin/Host header validation, restrict network access via firewall/security group rules to only trusted MCP clients, and temporarily de-register or disable shell, file-write, and code-execution tools on any exposed instance. For detection, review access/proxy logs for unexpected connections to /sse or /messages/ from unfamiliar IPs or browser-origin Referer/Origin headers, and audit which tools are currently registered on all running ToolsMCPServer instances to gauge actual exposure.

What systems are affected by CVE-2026-57123?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent tool servers (MCP), local/self-hosted AI agent deployments.

What is the CVSS score for CVE-2026-57123?

CVE-2026-57123 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.47%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent tool servers (MCP)local/self-hosted AI agent deployments

MITRE ATLAS Techniques

AML.T0006 Active Scanning

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0084.001 Tool Definitions

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: MANAGE-1.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.run_sse and launch_tools_mcp_server bind to 0.0.0.0 and create /sse and /messages/ routes without invoking the available SecurityConfig authentication, origin-validation, or DNS-rebinding controls. Any reachable client can list and invoke registered tools, and a browser can target a local instance through DNS rebinding, with impact determined by the registered file, shell, and code-execution tools. This vulnerability is fixed in praisonaiagents 1.6.59.

Exploitation Scenario

An attacker on the same network (or the public internet, if port-forwarded) discovers an exposed praisonaiagents ToolsMCPServer instance via scanning for the characteristic /sse endpoint. Because no authentication or origin check is enforced, they connect directly and issue a tool-listing request, revealing which tools the agent has access to. If a shell or code-execution tool is registered, they invoke it directly through /messages/ with an arbitrary command payload, achieving remote code execution on the host. Alternatively, against a developer instance believed to be safely bound to localhost, the attacker lures the victim to a malicious webpage that uses DNS rebinding — first resolving to an attacker-controlled IP to pass same-origin checks, then re-resolving to 127.0.0.1 — letting browser JavaScript reach the local SSE endpoint and repeat the same tool-invocation attack from inside the victim's browser session.

Weaknesses (CWE)

CWE-1327 Binding to an Unrestricted IP Address Primary CWE-306 Missing Authentication for Critical Function Primary CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action Primary CWE-1327 Binding to an Unrestricted IP Address CWE-306 Missing Authentication for Critical Function CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action

CWE-1327 — Binding to an Unrestricted IP Address: The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.

[System Configuration] Assign IP addresses that are not 0.0.0.0.
[System Configuration] Unwanted connections to the configured server may be denied through a firewall or other packet filtering measures.

Source: MITRE CWE corpus.