AI Threat AlertCVE-2026-57123: PraisonAI: unauthenticated MCP tool server enables RCE
CRITICALPoC AVAILABLECISA: TRACK*PraisonAI's agent tool server (ToolsMCPServer) binds to 0.0.0.0 and exposes its /sse and /messages/ routes without ever invoking the framework's own SecurityConfig authentication, origin-validation, or DNS-rebinding protections, so any network-reachable client — or even a browser via DNS rebinding against a 'localhost-only' instance — can list and invoke every registered agent tool. This is a network-exploitable, no-privilege, no-user-interaction flaw (CVSS 9.8) in an agent framework where tools commonly include shell execution, file access, and code interpreters, meaning the practical blast radius is full host compromise rather than a contained data leak. There is no EPSS score, CISA KEV listing, public exploit, or Nuclei template yet, so this looks unweaponized today, but the flaw is trivial to find (unauthenticated endpoints, no auth bypass needed) and PraisonAI is an actively used multi-agent framework, making rapid exploitation plausible once scanners catch up. Patch to praisonaiagents 1.6.59 immediately; until then, do not expose ToolsMCPServer beyond 127.0.0.1, front it with an authenticating reverse proxy that validates Origin/Host headers, and audit which tools (especially shell/file/code-exec) are registered on any instance that has ever been network-reachable.
What is the risk?
Critical and trivially exploitable: CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) reflects that no credentials, prior access, or user interaction are needed — an attacker only needs network reachability to the SSE endpoint, or a victim visiting a malicious webpage if the DNS-rebinding path is used against a 'local-only' deployment. Actual severity is tool-dependent: instances exposing only read-only or low-risk tools face information disclosure and tool-abuse risk, while instances registering shell, file-write, or code-execution tools (common in agentic setups) face full remote code execution. Exposure is elevated because 0.0.0.0 binding is the vulnerable default, meaning any deployment that didn't explicitly restrict network access or add its own auth layer in front is affected.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| PraisonAI Agents | pip | — | No patch |
Do you use PraisonAI Agents? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 stepUpgrade to praisonaiagents 1.6.59 or later immediately — the fix adds the missing SecurityConfig authentication, origin validation, and DNS-rebinding protections to the /sse and /messages/ routes. If immediate patching isn't possible: bind the tool server to 127.0.0.1 instead of 0.0.0.0, place it behind a reverse proxy that enforces authentication and strict Origin/Host header validation, restrict network access via firewall/security group rules to only trusted MCP clients, and temporarily de-register or disable shell, file-write, and code-execution tools on any exposed instance. For detection, review access/proxy logs for unexpected connections to /sse or /messages/ from unfamiliar IPs or browser-origin Referer/Origin headers, and audit which tools are currently registered on all running ToolsMCPServer instances to gauge actual exposure.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-57123?
PraisonAI's agent tool server (ToolsMCPServer) binds to 0.0.0.0 and exposes its /sse and /messages/ routes without ever invoking the framework's own SecurityConfig authentication, origin-validation, or DNS-rebinding protections, so any network-reachable client — or even a browser via DNS rebinding against a 'localhost-only' instance — can list and invoke every registered agent tool. This is a network-exploitable, no-privilege, no-user-interaction flaw (CVSS 9.8) in an agent framework where tools commonly include shell execution, file access, and code interpreters, meaning the practical blast radius is full host compromise rather than a contained data leak. There is no EPSS score, CISA KEV listing, public exploit, or Nuclei template yet, so this looks unweaponized today, but the flaw is trivial to find (unauthenticated endpoints, no auth bypass needed) and PraisonAI is an actively used multi-agent framework, making rapid exploitation plausible once scanners catch up. Patch to praisonaiagents 1.6.59 immediately; until then, do not expose ToolsMCPServer beyond 127.0.0.1, front it with an authenticating reverse proxy that validates Origin/Host headers, and audit which tools (especially shell/file/code-exec) are registered on any instance that has ever been network-reachable.
Is CVE-2026-57123 actively exploited?
Proof-of-concept exploit code is publicly available for CVE-2026-57123, increasing the risk of exploitation.
How to fix CVE-2026-57123?
Upgrade to praisonaiagents 1.6.59 or later immediately — the fix adds the missing SecurityConfig authentication, origin validation, and DNS-rebinding protections to the /sse and /messages/ routes. If immediate patching isn't possible: bind the tool server to 127.0.0.1 instead of 0.0.0.0, place it behind a reverse proxy that enforces authentication and strict Origin/Host header validation, restrict network access via firewall/security group rules to only trusted MCP clients, and temporarily de-register or disable shell, file-write, and code-execution tools on any exposed instance. For detection, review access/proxy logs for unexpected connections to /sse or /messages/ from unfamiliar IPs or browser-origin Referer/Origin headers, and audit which tools are currently registered on all running ToolsMCPServer instances to gauge actual exposure.
What systems are affected by CVE-2026-57123?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent tool servers (MCP), local/self-hosted AI agent deployments.
What is the CVSS score for CVE-2026-57123?
CVE-2026-57123 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.90%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0006Active ScanningAML.T0049Exploit Public-Facing ApplicationAML.T0053AI Agent Tool InvocationAML.T0084.001Tool DefinitionsCompliance Controls Affected
What are the technical details?
Original Advisory
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.run_sse and launch_tools_mcp_server bind to 0.0.0.0 and create /sse and /messages/ routes without invoking the available SecurityConfig authentication, origin-validation, or DNS-rebinding controls. Any reachable client can list and invoke registered tools, and a browser can target a local instance through DNS rebinding, with impact determined by the registered file, shell, and code-execution tools. This vulnerability is fixed in praisonaiagents 1.6.59.
Exploitation Scenario
An attacker on the same network (or the public internet, if port-forwarded) discovers an exposed praisonaiagents ToolsMCPServer instance via scanning for the characteristic /sse endpoint. Because no authentication or origin check is enforced, they connect directly and issue a tool-listing request, revealing which tools the agent has access to. If a shell or code-execution tool is registered, they invoke it directly through /messages/ with an arbitrary command payload, achieving remote code execution on the host. Alternatively, against a developer instance believed to be safely bound to localhost, the attacker lures the victim to a malicious webpage that uses DNS rebinding — first resolving to an attacker-controlled IP to pass same-origin checks, then re-resolving to 127.0.0.1 — letting browser JavaScript reach the local SSE endpoint and repeat the same tool-invocation attack from inside the victim's browser session.
Weaknesses (CWE)
CWE-1327Binding to an Unrestricted IP AddressPrimaryCWE-306Missing Authentication for Critical FunctionalityPrimaryCWE-350Reliance on Reverse DNS Resolution for a Security-Critical ActionPrimaryCWE-1327Binding to an Unrestricted IP AddressCWE-306Missing Authentication for Critical FunctionalityCWE-350Reliance on Reverse DNS Resolution for a Security-Critical ActionCWE-1327 — Binding to an Unrestricted IP Address: The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.
- [System Configuration] Assign IP addresses that are not 0.0.0.0.
- [System Configuration] Unwanted connections to the configured server may be denied through a firewall or other packet filtering measures.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
Timeline
Related Vulnerabilities
CVE-2026-3493810.0praisonaiagents: sandbox bypass enables full host RCE
Same package: praisonaiagentsCVE-2026-3988810.0praisonaiagents: sandbox escape enables host RCE
Same package: praisonaiagentsCVE-2026-6144710.0PraisonAI: RCE via unsandboxed LLM code execution
Same package: praisonaiagentsCVE-2026-473929.9praisonaiagents: RCE via Python sandbox bypass
Same package: praisonaiagentsGHSA-vc46-vw85-3wvm9.8PraisonAI: RCE via malicious workflow YAML execution
Same package: praisonaiagents