Security Flaw in PraisonAI Affects Multiple Versions
CVE-2026-57112

8.3HIGH

Key Information:

Vendor

Mervinpraison

Status
Praisonai
Praisonaiagents
Vendor
CVE Published:
15 September 2026

What is CVE-2026-57112?

PraisonAI features a significant vulnerability where its multi-agent system improperly secures sensitive endpoints. Specifically, the ToolsMCPServer.run_sse() function allows mounting of SseServerTransport on legacy /sse and /messages/ endpoints without enforcing Host, Origin, or authentication checks. This exposes the server to potential DNS rebinding attacks from malicious websites. Attackers can manipulate Host and Origin headers, enumerating registered tools and executing actions with the privileges of the server user. While the newer Streamable HTTP transport mitigates this risk by rejecting hostile Origins, the flaw primarily affects the legacy SSE wrapper. Remediation was implemented in versions 1.6.59 of praisonaiagents and 4.6.59 of PraisonAI.

Affected Version(s)

PraisonAI >= 3.10.0, < 4.6.59

praisonaiagents >= 0.6.0, < 1.6.59

References

https://github.com/MervinPraison/PraisonAI/security/advis...
x_refsource_CONFIRM
https://github.com/MervinPraison/PraisonAI/commit/2adfe7e...
x_refsource_MISC
https://github.com/MervinPraison/PraisonAI/releases/tag/v...
x_refsource_MISC

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.