CVE-2026-57124: PraisonAI unauth RCE

CISO Take

PraisonAI's multi-agent UI exposes an unauthenticated POST /api/mcp/connect endpoint that passes attacker-controlled command and args values straight into StdioMCPClient, letting any reachable client spawn arbitrary local processes as the UI service account — and this happens even if the MCP handshake itself later fails, so there is no need to complete a valid MCP session. This is a maximum-severity issue (CVSS 9.8, network vector, no privileges or user interaction required), made worse by the fact these UI hosts bind to 0.0.0.0 by default, meaning any deployment that isn't explicitly firewalled is network- or internet-reachable out of the box. There's no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template yet, so this looks pre-weaponization rather than actively exploited — but the trivial exploitation path (a single unauthenticated HTTP POST) means that window is unlikely to last. Patch to PraisonAI 4.6.59 immediately, and in the interim verify no PraisonAI UI instances are bound to a public or unsegmented interface, and treat any currently exposed instance as potentially compromised.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Critical risk. The vulnerability requires no authentication, no user interaction, and low attack complexity (AV:N/AC:L/PR:N/UI:N), and results in full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) since it grants arbitrary command execution as the UI service account. Default 0.0.0.0 binding significantly widens the exposure surface beyond what operators may expect from a 'local' agent UI. Mitigating factors are the absence of confirmed active exploitation (not in CISA KEV), no published EPSS score, and no known public exploit code or scanner template — but given the low complexity of the flaw (unauthenticated command injection over HTTP), functional exploit code is straightforward to develop, so risk should be treated as high-urgency despite the lack of current in-the-wild signals.

How does the attack unfold?

Initial Access

Attacker reaches a PraisonAI UI instance bound to 0.0.0.0 over the network without needing any credentials.

AML.T0049

Exploitation

Attacker sends an unauthenticated POST to /api/mcp/connect with malicious command and args values.

AML.T0053

Command Execution

StdioMCPClient spawns the attacker-controlled process as the UI service account, regardless of whether the MCP handshake later succeeds.

AML.T0050

Impact

Attacker achieves full compromise of the host running the agent orchestration platform, enabling credential theft, agent tampering, or lateral movement.

AML.T0112.000

Initial Access

Attacker reaches a PraisonAI UI instance bound to 0.0.0.0 over the network without needing any credentials.

AML.T0049

Exploitation

Attacker sends an unauthenticated POST to /api/mcp/connect with malicious command and args values.

AML.T0053

Command Execution

StdioMCPClient spawns the attacker-controlled process as the UI service account, regardless of whether the MCP handshake later succeeds.

AML.T0050

Impact

Attacker achieves full compromise of the host running the agent orchestration platform, enabling credential theft, agent tampering, or lateral movement.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 49% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade PraisonAI to version 4.6.59 or later immediately. Until patched, do not expose the PraisonAI UI on 0.0.0.0 or any public/shared interface — bind it to localhost or an internal-only interface and front it with authentication (reverse proxy with auth, VPN, or network ACLs). Audit network exposure now: scan for PraisonAI UI instances reachable from outside trusted networks. Review process execution and outbound connection logs on hosts running PraisonAI for unexpected child processes spawned around POST requests to /api/mcp/connect. Rotate credentials and API keys accessible to the PraisonAI UI service account if any exposure is confirmed or suspected.

How is it classified?

Auth Bypass Code Execution Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system operation and monitoring

NIST AI RMF

MANAGE 4.1 - Risk treatment and monitoring for deployed AI systems

OWASP LLM Top 10

LLM08:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-57124?

PraisonAI's multi-agent UI exposes an unauthenticated POST /api/mcp/connect endpoint that passes attacker-controlled command and args values straight into StdioMCPClient, letting any reachable client spawn arbitrary local processes as the UI service account — and this happens even if the MCP handshake itself later fails, so there is no need to complete a valid MCP session. This is a maximum-severity issue (CVSS 9.8, network vector, no privileges or user interaction required), made worse by the fact these UI hosts bind to 0.0.0.0 by default, meaning any deployment that isn't explicitly firewalled is network- or internet-reachable out of the box. There's no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template yet, so this looks pre-weaponization rather than actively exploited — but the trivial exploitation path (a single unauthenticated HTTP POST) means that window is unlikely to last. Patch to PraisonAI 4.6.59 immediately, and in the interim verify no PraisonAI UI instances are bound to a public or unsegmented interface, and treat any currently exposed instance as potentially compromised.

Is CVE-2026-57124 actively exploited?

No confirmed active exploitation of CVE-2026-57124 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-57124?

Upgrade PraisonAI to version 4.6.59 or later immediately. Until patched, do not expose the PraisonAI UI on 0.0.0.0 or any public/shared interface — bind it to localhost or an internal-only interface and front it with authentication (reverse proxy with auth, VPN, or network ACLs). Audit network exposure now: scan for PraisonAI UI instances reachable from outside trusted networks. Review process execution and outbound connection logs on hosts running PraisonAI for unexpected child processes spawned around POST requests to /api/mcp/connect. Rotate credentials and API keys accessible to the PraisonAI UI service account if any exposure is confirmed or suspected.

What systems are affected by CVE-2026-57124?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP integrations, multi-agent orchestration.

What is the CVSS score for CVE-2026-57124?

CVE-2026-57124 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.64%.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP integrationsmulti-agent orchestration

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 4.1

OWASP LLM Top 10: LLM08:2025

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands bind to 0.0.0.0 by default, a reachable unauthenticated client can execute commands as the UI service account even when the MCP handshake later fails. This vulnerability is fixed in 4.6.59.

Exploitation Scenario

An attacker scans internal or internet-facing IP ranges for PraisonAI UI instances listening on their default port (reachable due to the 0.0.0.0 bind). Finding one, they send a single unauthenticated HTTP POST to /api/mcp/connect with a crafted command (e.g., a shell invocation) and args designed to establish a reverse shell or download and execute a payload. PraisonAIUI passes these values directly to StdioMCPClient, which spawns the process to attempt the MCP handshake — the malicious command executes as the UI service account regardless of whether the MCP protocol handshake that follows succeeds or fails. The attacker now has code execution on the host running the agent orchestration platform, from which they can harvest agent configs and credentials, tamper with agent tool definitions, or pivot further into the environment.

Weaknesses (CWE)

CWE-306 Missing Authentication for Critical Function Primary CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Primary CWE-306 Missing Authentication for Critical Function CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-306 — Missing Authentication for Critical Function: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.