PT-2026-61777 · Pypi · Praisonaiagents

CVE-2026-57123

·

Published

2026-06-18

·

Updated

2026-07-23

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions praisonai-agents (affected versions not specified)
Description The MCP SSE server, when started via ToolsMCPServer.run sse() or launch tools mcp server(transport="sse"), binds to 0.0.0.0 by default and lacks authentication middleware and Origin-header validation. Although the mcp/mcp security.py module contains necessary security controls, these functions are not called by any transport, rendering them dead code. This allows any host with network access to the port to list and invoke registered tools without credentials. Additionally, a victim's browser can trigger these calls against a localhost instance through DNS rebinding, a technique where a malicious website tricks a browser into making requests to a local IP address. If registered tools include file, shell, or code execution capabilities, this can lead to Remote Code Execution (RCE). The issue affects the /sse and /messages/ endpoints.
Recommendations
  • Change the default host of run sse() to 127.0.0.1 and require explicit opt-in for 0.0.0.0.
  • Implement Starlette middleware that utilizes is valid origin() and is potential dns rebinding() to reject unauthorized origins.
  • Enforce the use of validate auth header() when SecurityConfig.require auth is enabled, and set require auth to True by default for any non-loopback binding.

Fix

Missing Authentication

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-350CWE-306CWE-1327

Related Identifiers

CVE-2026-57123
GHSA-X227-PF99-VFFG
PYSEC-2026-3536

Affected Products

Praisonaiagents