CVE-2026-57139: PraisonAI: unauthenticated MCP server exposes agent tools

CRITICALPoC AVAILABLECISA: ATTEND

Published September 15, 2026

CISO Take

PraisonAI's TypeScript MCPServer.startHttp() (versions 1.5.0 through 1.7.2) listens without a host restriction and passes every HTTP POST to its request handler with no authentication or authorization. Anyone who can reach the port can list and call registered tools and read resources and prompts, which run with the server's credentials and process privileges. This is a CVSS 9.8 flaw, but real-world urgency is moderate for now: EPSS is 0.75% (46th percentile), it is not in CISA KEV, and there is no public exploit or Nuclei template, although CISA SSVC rates it ATTEND. Exposure depends on whether the MCP server is reachable beyond localhost, so inventory any PraisonAI TypeScript deployments that use MCPServer, upgrade past the initial fix in 1.7.2 (the advisory notes that remediation was only an initial one, so check GHSA-j4f3-55x4-r6q2 for the final fixed release), and firewall or authenticate the port until you have done so.

Sources:NVDEPSSGitHub AdvisoryATLASCISA SSVC

What is the risk?

Critical severity (CVSS 9.8) with network attack vector, low complexity, no privileges and no user interaction. Exploitation is trivial for anyone who can reach the port: a single unauthenticated HTTP POST can invoke tools. Current exploitation likelihood is modest (EPSS 0.00754, top 46%, not in KEV, no public exploit or scanner template). Actual impact depends on which tools, secrets and data sources are registered on the server. Because the default bind is unrestricted, servers on shared networks, cloud VMs or containers with published ports are at the highest risk. The advisory describes the 1.7.2 fix as an initial remediation, so residual risk may remain in that version.

How does the attack unfold?

Discovery

Attacker locates a reachable PraisonAI MCP HTTP port through network scanning or internal reconnaissance.

AML.T0006

Initial Access

Attacker sends unauthenticated JSON-RPC POST requests to the MCP endpoint, which are accepted without any credentials.

AML.T0049

Tool Enumeration and Invocation

Attacker lists registered tools with tools/list and invokes them with tools/call to run handlers using server-side credentials.

AML.T0053

Impact

Attacker reads resources and prompts and abuses tool privileges to exfiltrate data or alter connected systems.

AML.T0085.001

Discovery

Attacker locates a reachable PraisonAI MCP HTTP port through network scanning or internal reconnaissance.

AML.T0006

Initial Access

Attacker sends unauthenticated JSON-RPC POST requests to the MCP endpoint, which are accepted without any credentials.

AML.T0049

Tool Enumeration and Invocation

Attacker lists registered tools with tools/list and invokes them with tools/call to run handlers using server-side credentials.

AML.T0053

Impact

Attacker reads resources and prompts and abuses tool privileges to exfiltrate data or alter connected systems.

AML.T0085.001

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents61% patched~23d to patchFull package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.8%

chance of exploitation in 30 days

Higher than 55% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade PraisonAI TypeScript to a release newer than 1.7.2 once the full fix is available, and review the GHSA-j4f3-55x4-r6q2 advisory and the referenced commit 709a038 for the final fixed version. 2) Until patched, bind the MCP server to 127.0.0.1 only, or place it behind a reverse proxy or API gateway that enforces authentication (mTLS, bearer tokens) and IP allow-lists. 3) Block the MCP port at the host and network firewall and in container or security-group rules. 4) Reduce the privileges and credentials available to registered tool handlers (least privilege, scoped short-lived tokens) and remove high-risk tools such as shell, file-write or database-admin tools from exposed servers. 5) Detection: search web and proxy logs for unexpected POSTs to the MCP endpoint, especially JSON-RPC methods tools/list, tools/call, resources/read and prompts/get from unknown source IPs; scan internal ranges for the open port; rotate any secrets that were reachable by the server if exposure is suspected.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableYes

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData ExtractionCode ExecutionAgentPluginFrameworkAML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation AML.T0084.001- Tool Definitions AML.T0085.001- AI Agent Tools AML.T0098- AI Agent Tool Credential Harvesting

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to and recover from previously unknown risks

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-57139?

Is CVE-2026-57139 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-57139, increasing the risk of exploitation.

How to fix CVE-2026-57139?

1) Upgrade PraisonAI TypeScript to a release newer than 1.7.2 once the full fix is available, and review the GHSA-j4f3-55x4-r6q2 advisory and the referenced commit 709a038 for the final fixed version. 2) Until patched, bind the MCP server to 127.0.0.1 only, or place it behind a reverse proxy or API gateway that enforces authentication (mTLS, bearer tokens) and IP allow-lists. 3) Block the MCP port at the host and network firewall and in container or security-group rules. 4) Reduce the privileges and credentials available to registered tool handlers (least privilege, scoped short-lived tokens) and remove high-risk tools such as shell, file-write or database-admin tools from exposed servers. 5) Detection: search web and proxy logs for unexpected POSTs to the MCP endpoint, especially JSON-RPC methods tools/list, tools/call, resources/read and prompts/get from unknown source IPs; scan internal ranges for the open port; rotate any secrets that were reachable by the server if exposure is suspected.

What systems are affected by CVE-2026-57139?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers, multi-agent systems, tool-calling pipelines.

What is the CVSS score for CVE-2026-57139?

CVE-2026-57139 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.75%.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP serversmulti-agent systemstool-calling pipelines

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

AML.T0084.001Tool Definitions

AML.T0085.001AI Agent Tools

AML.T0098AI Agent Tool Credential Harvesting

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp() in src/praisonai-ts/src/mcp/server.ts binds without a host restriction and forwards every HTTP POST request to handleRequest() without authentication or authorization. Any network client that can reach the port can call tools/list, tools/call, resources/read, or prompts/get, causing registered handlers to run with server-side credentials and process privileges or disclose registered data. An initial remediation was released in version 1.7.2.

Exploitation Scenario

An attacker scans for hosts running a PraisonAI MCP server, or finds one on an internal network after an initial foothold. They send an unauthenticated JSON-RPC POST with tools/list to enumerate the registered tools, then call tools/call to run tools such as a database query, file reader or internal API client. They also call resources/read and prompts/get to pull registered data and system prompts. Because the handlers use the server's credentials, the attacker uses them to exfiltrate data, take actions in connected SaaS or cloud systems, or move laterally, without ever interacting with the LLM.

Weaknesses (CWE)

CWE-1188Initialization of a Resource with an Insecure DefaultPrimary CWE-306Missing Authentication for Critical FunctionalityPrimary CWE-862Missing AuthorizationPrimary CWE-1188Initialization of a Resource with an Insecure Default CWE-306Missing Authentication for Critical Functionality CWE-862Missing Authorization

CWE-1188 — Initialization of a Resource with an Insecure Default: The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Source: MITRE CWE corpus.