CVE-2026-55532

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58

Description A Cross-Site Request Forgery (CSRF) issue exists in the MCP HTTP-stream transport. The validate origin() function in transports/http stream.py uses a prefix match via startswith() to validate the request origin variable against an allowlist. This allows an attacker to bypass the check by using a domain that begins with an allowed prefix, such as http://localhost.attacker.com.

Because the server may be run without an API key by default and parses request bodies regardless of the Content-Type header, an attacker can send a CORS simple request using text/plain. This bypasses the browser preflight check and allows the unauthenticated invocation of the tools/call endpoint.

An attacker can exploit this to perform state-changing actions, most notably using the praisonai.rules.create tool to write malicious files into the global rules directory. This results in persistent prompt injection, where attacker-controlled instructions are applied to every subsequent agent run on the victim's machine, potentially leading to the exfiltration of sensitive data like SSH keys and API keys. Other affected tools include praisonai.rules.delete, praisonai.todo.add, praisonai.todo.delete, and praisonai.schedule.add.

Recommendations Update PraisonAI to version 4.6.58. As a temporary mitigation, configure the MCP server with a strong API key using the --api-key flag to enable authentication for the HTTP-stream transport.