CVE-2026-57112 PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
Attackers can bypass authentication on legacy SSE endpoints to enumerate and invoke AI tools with server privileges via DNS rebinding.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-57112?
CVE-2026-57112 is a high-severity missing authorization vulnerability in MervinPraison PraisonAI, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, ToolsMCPServer.run_sse() in src/praisonai-agents/praisonaiagents/mcp/mcp_server.py mounts SseServerTransport on the legacy /sse and /messages/ endpoints without default Host, Origin, or authentication enforcement. A malicious website can use DNS rebinding against a reachable local or internal SSE server, supply attacker-controlled Host and Origin headers, enumerate registered tools, and invoke them with the server user's privileges. The Streamable HTTP transport rejects the same hostile Origin, which isolates the flaw to the legacy SSE wrapper. An initial remediation was released in praisonaiagents 1.6.59 and PraisonAI 4.6.59.
Which versions are affected by CVE-2026-57112?
6 open source packages ship an affected version, including praisonai and praisonaiagents.
| Package | Affected | Fixed in |
|---|---|---|
praisonai PyPI | From 3.10.0 | 4.6.59 |
praisonai PyPI | From 3.10.0 | 4.6.59 |
praisonai PyPI | From 3.10.0 | 4.6.59 |
praisonaiagents PyPI | From 0.6.0 | 1.6.59 |
praisonaiagents PyPI | From 0.6.0 | 1.6.59 |
praisonaiagents PyPI | From 0.6.0 | 1.6.59 |
How do I fix CVE-2026-57112?
Upgrade praisonai to 4.6.59 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-57112 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-57112 exists.
Sources
Also known as GHSA-vmf9-xx9w-86wx, PYSEC-2026-3521, PYSEC-2026-3534.