https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 12:03:12 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-55532 <p>PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream _validate_origin uses request_origin.startswith(allowed), allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests without preflight and invoke tools/call without an API key, including file writes that persist agent instructions. This issue is fixed in version 4.6.58.</p> <p>PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream _validate_origin uses request_origin.startswith(allowed), allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests without preflight and invoke tools/call without an API key, including file writes that persist agent instructions. This issue is fixed in version 4.6.58.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-55532 https://vulnerability.circl.lu/vuln/ghsa-pvph-5j39-v8qc <p><strong>Affected:</strong> PyPI: PraisonAI</p> <p>### Summary</p> <p>The PraisonAI MCP server exposes an HTTP-stream transport (praisonai mcp serve --transport http-stream) that binds to localhost and, by default, has no API key. Its only access control for browser-originated requests is an Origin allowlist, which the code implements as required by the MCP 2025-11-25 security guidance. The allowlist check uses a prefix match (request_origin.startswith(allowed)), so any Origin whose string begins with http://localhost or http://127.0.0.1 is accepted, for example http://localhost.attacker.com. An attacker who registers such a hostname and serves a page from it can, when a victim visits the page, issue cross-site requests that the MCP server accepts and executes without authentication. Because the request can be sent as a CORS &#34;simple request&#34; (Content-Type: text/plain, which the server still parses as JSON), it requires no preflight, and because tools/call does not require a session, a single forged request executes an MCP tool. This is a blind cross-site request forgery against a developer&#39;s local agent runtime. A natural end-to-end impact is persistent prompt injection: the forged request creates a rule file that the agent runtime loads with activation &#34;always&#34;, so attacker-controlled instructions are injected into every subsequent agent run on the victim&#39;s machine.</p> <p>### Details</p> <p>The HTTP-stream transport validates the Origin header in transports/http_stream.py. The allowlist is built for a localhost bind, then matched with start…</p> <p><strong>Affected:</strong> PyPI: PraisonAI</p> <p>### Summary</p> <p>The PraisonAI MCP server exposes an HTTP-stream transport (praisonai mcp serve --transport http-stream) that binds to localhost and, by default, has no API key. Its only access control for browser-originated requests is an Origin allowlist, which the code implements as required by the MCP 2025-11-25 security guidance. The allowlist check uses a prefix match (request_origin.startswith(allowed)), so any Origin whose string begins with http://localhost or http://127.0.0.1 is accepted, for example http://localhost.attacker.com. An attacker who registers such a hostname and serves a page from it can, when a victim visits the page, issue cross-site requests that the MCP server accepts and executes without authentication. Because the request can be sent as a CORS &#34;simple request&#34; (Content-Type: text/plain, which the server still parses as JSON), it requires no preflight, and because tools/call does not require a session, a single forged request executes an MCP tool. This is a blind cross-site request forgery against a developer&#39;s local agent runtime. A natural end-to-end impact is persistent prompt injection: the forged request creates a rule file that the agent runtime loads with activation &#34;always&#34;, so attacker-controlled instructions are injected into every subsequent agent run on the victim&#39;s machine.</p> <p>### Details</p> <p>The HTTP-stream transport validates the Origin header in transports/http_stream.py. The allowlist is built for a localhost bind, then matched with start…</p> https://vulnerability.circl.lu/vuln/ghsa-pvph-5j39-v8qc https://vulnerability.circl.lu/vuln/pysec-2026-3892 <p><strong>Affected:</strong> PyPI: praisonai</p> <p>### Summary</p> <p>The PraisonAI MCP server exposes an HTTP-stream transport (praisonai mcp serve --transport http-stream) that binds to localhost and, by default, has no API key. Its only access control for browser-originated requests is an Origin allowlist, which the code implements as required by the MCP 2025-11-25 security guidance. The allowlist check uses a prefix match (request_origin.startswith(allowed)), so any Origin whose string begins with http://localhost or http://127.0.0.1 is accepted, for example http://localhost.attacker.com. An attacker who registers such a hostname and serves a page from it can, when a victim visits the page, issue cross-site requests that the MCP server accepts and executes without authentication. Because the request can be sent as a CORS &#34;simple request&#34; (Content-Type: text/plain, which the server still parses as JSON), it requires no preflight, and because tools/call does not require a session, a single forged request executes an MCP tool. This is a blind cross-site request forgery against a developer&#39;s local agent runtime. A natural end-to-end impact is persistent prompt injection: the forged request creates a rule file that the agent runtime loads with activation &#34;always&#34;, so attacker-controlled instructions are injected into every subsequent agent run on the victim&#39;s machine.</p> <p>### Details</p> <p>The HTTP-stream transport validates the Origin header in transports/http_stream.py. The allowlist is built for a localhost bind, then matched with start…</p> <p><strong>Affected:</strong> PyPI: praisonai</p> <p>### Summary</p> <p>The PraisonAI MCP server exposes an HTTP-stream transport (praisonai mcp serve --transport http-stream) that binds to localhost and, by default, has no API key. Its only access control for browser-originated requests is an Origin allowlist, which the code implements as required by the MCP 2025-11-25 security guidance. The allowlist check uses a prefix match (request_origin.startswith(allowed)), so any Origin whose string begins with http://localhost or http://127.0.0.1 is accepted, for example http://localhost.attacker.com. An attacker who registers such a hostname and serves a page from it can, when a victim visits the page, issue cross-site requests that the MCP server accepts and executes without authentication. Because the request can be sent as a CORS &#34;simple request&#34; (Content-Type: text/plain, which the server still parses as JSON), it requires no preflight, and because tools/call does not require a session, a single forged request executes an MCP tool. This is a blind cross-site request forgery against a developer&#39;s local agent runtime. A natural end-to-end impact is persistent prompt injection: the forged request creates a rule file that the agent runtime loads with activation &#34;always&#34;, so attacker-controlled instructions are injected into every subsequent agent run on the victim&#39;s machine.</p> <p>### Details</p> <p>The HTTP-stream transport validates the Origin header in transports/http_stream.py. The allowlist is built for a localhost bind, then matched with start…</p> https://vulnerability.circl.lu/vuln/pysec-2026-3892