CVE-2026-55529

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58

Description The MCP HTTP Stream transport in PraisonAI uses an unsafe prefix match when validating the Origin header via the validate origin() method. The validation logic accepts any origin that starts with an allowed value, meaning an attacker-controlled origin such as http://localhost.evil.example can bypass the localhost allowlist because it starts with http://localhost.

When the MCP HTTP Stream server is started without an API key (the CLI default), a malicious webpage can trigger unauthenticated tools/call requests against a locally running server. This allows the execution of exposed tools, such as praisonai.files.create(), which can read local files, or praisonai.todo.add(), which can modify local state files.

Recommendations Update PraisonAI to version 4.6.58 or later. Configure a strong API key for the MCP server to enforce authentication. Explicitly define a strict list of allowed-origins instead of relying on the default localhost allowlist.