External risk intelligence

PraisonAI MCPServer Unauthorized Command Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-57139

The vulnerability exists in an HTTP server component that binds without host restrictions and processes requests without authentication. As a multi-agent system component configured to listen for HTTP traffic, it functions as an API or service endpoint that is commonly deployed in network-reachable configurations.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in PraisonAI, a multi-agent system. The issue allows any network client to access sensitive tools, resources, and data without authentication, potentially leading to unauthorized actions or data disclosure. The primary concern is to confirm if this technology is in use and assess potential exposure.

Unauthenticated access to system functions and data.
Critical vulnerability could expose sensitive operations.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can reach this vulnerability by sending HTTP POST requests to the affected system's port over the network. The system's `MCPServer.startHttp()` function fails to restrict which hosts can access it or to check user authentication, leading it to forward all incoming POST requests to `handleRequest()`. This allows unauthenticated network clients to execute server-side commands, access sensitive data, or trigger unintended actions.

Network access required.
Unauthenticated HTTP POST requests.
Server compromise or data exposure.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow any network-connected client to execute server-side code, access registered data, or run system commands without authentication or authorization when the PraisonAI MCPServer is running. This could impact the integrity and confidentiality of data processed by the server and potentially lead to unauthorized actions on the system.

Server-side code and data assets at risk.
Unauthenticated network requests.
Unauthorized code execution and data disclosure.

Operational Fix

Recommended remediation, mitigation, and detection steps

The PraisonAI system's MCPServer component is likely managed by the platform or infrastructure team responsible for its deployment. The first action should be to identify all instances of the affected PraisonAI, determine their network exposure and business criticality, and then assign ownership for remediation planning.

Platform or infrastructure teams own this.
Verify network exposure and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is PraisonAI?

PraisonAI is a framework designed to coordinate multi-agent teams, which are groups of autonomous AI systems working together to perform tasks. The affected MCPServer component acts as a bridge, allowing these AI agents to communicate via HTTP. Users typically deploy this technology to build automated workflows where agents need to access tools, data, or system prompts to complete their objectives.

What is the vulnerability in CVE-2026-57139?

This vulnerability is classified as an authentication and authorization failure (CWE-306 and CWE-862). Essentially, the server fails to verify the identity of anyone sending a request and does not check if they have permission to perform actions. Because the software accepts all incoming HTTP POST requests, it mistakenly assumes that every command received is authorized, allowing strangers to execute sensitive functions.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending a specially crafted HTTP POST request to the port where the MCPServer is listening. It is important to note that internal logic, such as pre-existing authorized sessions, does not prevent this; the server accepts requests from any network client. Simply being able to reach the server's network port is enough for an attacker to bypass security, as the system does not differentiate between trusted and untrusted traffic.

How do I know if my PraisonAI instance is relevant?

According to Halo Surface Signal, this vulnerability is highly relevant if your instance is network-reachable, as the service is designed to function as an API endpoint. You should consider your deployment exposed if the MCPServer is configured to accept traffic from outside your local host or internal network. If the service is running and accessible to other devices, it is a high-priority concern due to the lack of host-based restrictions.

What is the first step for responding to this issue?

Begin by auditing your infrastructure to locate every instance of PraisonAI within your environment. Once you have an inventory, verify the network configuration for each instance to determine if it is exposed to untrusted traffic. After identifying these assets, coordinate with your infrastructure or platform teams to prioritize remediation, focusing on updates or access controls that restrict connectivity to these server components.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.