AI Threat AlertCVE-2026-57134: PraisonAI: MCP auth bypass via unchecked Basic/OAuth
HIGHPoC AVAILABLECISA: TRACK*PraisonAI's TypeScript MCP security layer (versions 1.5.1 to before 1.7.2) never calls the credential validator for Basic and OAuth policies, so any non-empty Authorization header is accepted as authenticated. An unauthenticated network attacker can therefore reach MCP tools and resources that the organization believes are protected, which for an agent framework can mean reading sensitive data and, to a lesser degree, modifying it (CVSS 8.2, high confidentiality impact). Exploitation likelihood is currently modest: EPSS is 0.41% (66th percentile), the CVE is not in CISA KEV, no public exploit or Nuclei template exists, and CISA SSVC is Track*; however, the attack is trivial because it needs only a bogus header. Upgrade to 1.7.2 or later, and audit any PraisonAI MCP endpoints that use Basic or OAuth policies for unexpected access since 1.5.1. Note that the advisory references vary on the exact fixed release (the referenced release tag is v4.6.60), so confirm the patched build against the GHSA before rolling out.
What is the risk?
High. The flaw is a network-reachable, zero-privilege, zero-interaction authentication bypass (CWE-287/288/863) with low complexity. Impact is high on confidentiality and low on integrity. Real-world exposure depends on whether MCP endpoints are internet- or network-reachable and configured with Basic or OAuth policies; deployments using api-key or bearer policies are not affected by this specific bypass. Exploitation signals are weak today (EPSS 0.41%, no KEV, no public PoC), but the trivial exploit means this could change quickly once the fix commit is analyzed.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| PraisonAI | pip | — | No patch |
Do you use PraisonAI? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade PraisonAI TypeScript to 1.7.2 or later (verify the fixed build against GHSA-4qq2-2j2x-x62c). 2) Until patched, switch affected MCP policies to api-key or bearer auth methods, where the validator is invoked, or place MCP endpoints behind a reverse proxy or gateway that performs real credential or token validation. 3) Restrict network exposure of MCP endpoints to trusted segments and apply IP allowlists. 4) Review MCP access logs since 1.5.1 for requests with unusual or malformed Authorization headers from unknown sources, and for unexpected tool invocations. 5) Rotate secrets reachable through MCP tools if suspicious access is found. 6) Inventory deployments using praisonai-ts and the MCPSecurity module via SBOM or dependency scanning.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-57134?
PraisonAI's TypeScript MCP security layer (versions 1.5.1 to before 1.7.2) never calls the credential validator for Basic and OAuth policies, so any non-empty Authorization header is accepted as authenticated. An unauthenticated network attacker can therefore reach MCP tools and resources that the organization believes are protected, which for an agent framework can mean reading sensitive data and, to a lesser degree, modifying it (CVSS 8.2, high confidentiality impact). Exploitation likelihood is currently modest: EPSS is 0.41% (66th percentile), the CVE is not in CISA KEV, no public exploit or Nuclei template exists, and CISA SSVC is Track*; however, the attack is trivial because it needs only a bogus header. Upgrade to 1.7.2 or later, and audit any PraisonAI MCP endpoints that use Basic or OAuth policies for unexpected access since 1.5.1. Note that the advisory references vary on the exact fixed release (the referenced release tag is v4.6.60), so confirm the patched build against the GHSA before rolling out.
Is CVE-2026-57134 actively exploited?
Proof-of-concept exploit code is publicly available for CVE-2026-57134, increasing the risk of exploitation.
How to fix CVE-2026-57134?
1) Upgrade PraisonAI TypeScript to 1.7.2 or later (verify the fixed build against GHSA-4qq2-2j2x-x62c). 2) Until patched, switch affected MCP policies to api-key or bearer auth methods, where the validator is invoked, or place MCP endpoints behind a reverse proxy or gateway that performs real credential or token validation. 3) Restrict network exposure of MCP endpoints to trusted segments and apply IP allowlists. 4) Review MCP access logs since 1.5.1 for requests with unusual or malformed Authorization headers from unknown sources, and for unexpected tool invocations. 5) Rotate secrets reachable through MCP tools if suspicious access is found. 6) Inventory deployments using praisonai-ts and the MCPSecurity module via SBOM or dependency scanning.
What systems are affected by CVE-2026-57134?
This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, MCP servers and tool gateways, Multi-agent orchestration, Tool-calling pipelines.
What is the CVSS score for CVE-2026-57134?
CVE-2026-57134 has a CVSS v3.1 base score of 8.2 (HIGH). The EPSS exploitation probability is 0.41%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0049Exploit Public-Facing ApplicationAML.T0053AI Agent Tool InvocationAML.T0084.001Tool DefinitionsAML.T0085.001AI Agent ToolsCompliance Controls Affected
What are the technical details?
Original Advisory
PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, MCPSecurity.evaluatePolicy() in src/praisonai-ts/src/mcp/security.ts invokes the configured credential validator only when AuthMethod is api-key or bearer. Basic and OAuth policies accept any non-empty Authorization header without calling auth.validate(), then return an authenticated result, allowing callers with invalid credentials to access MCP tools and resources protected by those policies. This issue is fixed in version 1.7.2.
Exploitation Scenario
An attacker discovers an exposed PraisonAI MCP endpoint configured with a Basic or OAuth policy. They send a request with an arbitrary header such as 'Authorization: Basic aaaa' and receive an authenticated result without the validator ever running. They enumerate available tools and resources, then invoke tools that read internal documents, query databases or call internal APIs, exfiltrating sensitive data. They may also call write-capable tools to alter records or agent state, using the agent's own privileges to pivot further.
Weaknesses (CWE)
CWE-287Improper AuthenticationPrimaryCWE-288Authentication Bypass Using an Alternate Path or ChannelPrimaryCWE-863Incorrect AuthorizationPrimaryCWE-287Improper AuthenticationCWE-288Authentication Bypass Using an Alternate Path or ChannelCWE-863Incorrect AuthorizationCWE-287 — Improper Authentication: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- [Architecture and Design] Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NReferences
Timeline
Related Vulnerabilities
CVE-2026-4816810.0PraisonAI: shell injection in Claude Action enables RCE
Same package: praisonaiCVE-2026-6144710.0PraisonAI: RCE via unsandboxed LLM code execution
Same package: praisonaiCVE-2026-614459.9PraisonAI: AICoder root RCE via unsanitized tool calls
Same package: praisonaiGHSA-vmmj-pfw7-fjwp9.9praisonai: sandbox escape gives RCE via codeMode tool
Same package: praisonaiCVE-2026-473929.9praisonaiagents: RCE via Python sandbox bypass
Same package: praisonai