PT-2026-61777

CVE-2026-57123

Published

2026-06-18

Updated

2026-09-16

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions praisonai-agents (affected versions not specified)

Description The MCP SSE server, when started via ToolsMCPServer.run sse() or launch tools mcp server(transport="sse"), binds to 0.0.0.0 by default and lacks authentication middleware and Origin-header validation. Although the mcp/mcp security.py module contains necessary security controls, these functions are not called by any transport, rendering them dead code. This allows any host with network access to the port to list and invoke registered tools without credentials. Additionally, a victim's browser can trigger these calls against a localhost instance through DNS rebinding, a technique where a malicious website tricks a browser into making requests to a local IP address. If registered tools include file, shell, or code execution capabilities, this can lead to Remote Code Execution (RCE). The issue affects the /sse and /messages/ endpoints.

Recommendations

Change the default host of run sse() to 127.0.0.1 and require explicit opt-in for 0.0.0.0.
Implement Starlette middleware that utilizes is valid origin() and is potential dns rebinding() to reject unauthorized origins.
Enforce the use of validate auth header() when SecurityConfig.require auth is enabled, and set require auth to True by default for any non-loopback binding.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-1327: Binding to an Unrestricted IP Address

CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action

CWE-306: Missing Authentication for Critical Function

Related identifiers

CVE-2026-57123