CyberRota Analysis
AI-GeneratedThe vulnerability exists in PraisonAI versions prior to 4.6.58, where the MCP HTTP Stream's _validate_origin method improperly allows attacker-controlled origins to bypass the localhost allowlist. This flaw enables unauthorized remote webpages to submit requests to the local MCP server, potentially executing exposed tools without an API key. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized access and potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream _validate_origin method accepts request_origin.startswith(allowed), so the attacker-controlled localhost.evil.example HTTP origin matches the localhost allowlist. Without an API key, a malicious webpage can submit tools/call requests to the local MCP server and execute exposed tools. This issue is fixed in version 4.6.58.