https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 21:35:37 +0000 https://vulnerability.circl.lu/vuln/cve-2026-57123 <p><strong>Affected:</strong> MervinPraison praisonaiagents</p> <p>PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.run_sse and launch_tools_mcp_server bind to 0.0.0.0 and create /sse and /messages/ routes without invoking the available SecurityConfig authentication, origin-validation, or DNS-rebinding controls. Any reachable client can list and invoke registered tools, and a browser can target a local instance through DNS rebinding, with impact determined by the registered file, shell, and code-execution tools. This vulnerability is fixed in praisonaiagents 1.6.59.</p> <p><strong>Affected:</strong> MervinPraison praisonaiagents</p> <p>PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.run_sse and launch_tools_mcp_server bind to 0.0.0.0 and create /sse and /messages/ routes without invoking the available SecurityConfig authentication, origin-validation, or DNS-rebinding controls. Any reachable client can list and invoke registered tools, and a browser can target a local instance through DNS rebinding, with impact determined by the registered file, shell, and code-execution tools. This vulnerability is fixed in praisonaiagents 1.6.59.</p> https://vulnerability.circl.lu/vuln/cve-2026-57123 https://vulnerability.circl.lu/vuln/ghsa-x227-pf99-vffg <p><strong>Affected:</strong> PyPI: praisonaiagents</p> <p>The MCP SSE server started via ToolsMCPServer.run_sse() / launch_tools_mcp_server(transport=&#34;sse&#34;) binds to 0.0.0.0 by default and builds its Starlette application with no authentication middleware and no Origin-header validation. The module mcp/mcp_security.py provides exactly the needed controls (origin validation, DNS-rebinding detection, auth-header enforcement, a SecurityConfig), but none of these functions are ever called by any transport — they are dead code. Any host that can reach the port can list and invoke every registered tool with no credentials, and a victim&#39;s browser can drive the same calls against a localhost instance via DNS rebinding.</p> <p>Affected code: src/praisonai-agents/praisonaiagents/mcp/mcp_server.py - run_sse defaults host to all interfaces (line 245) and builds the app with only `debug` and `routes` - no `middleware=` and no per-route auth/origin gate (lines ~271-289): app = Starlette(debug=self._debug, routes=[ Route(sse_path, endpoint=handle_sse), # &#34;/sse&#34; Mount(messages_path, app=sse_transport.handle_post_message), # &#34;/messages/&#34; ]) uvicorn.run(app, host=host, port=port) - launch_tools_mcp_server also defaults host=&#34;0.0.0.0&#34; (line 301).</p> <p>src/praisonai-agents/praisonaiagents/mcp/mcp_security.py defines but the transports never call: - is_valid_origin (line 30), is_potential_dns_rebinding (line 110), validate_auth_header (line 167), SecurityConfig.is_origin_allowed (line 236). The…</p> <p><strong>Affected:</strong> PyPI: praisonaiagents</p> <p>The MCP SSE server started via ToolsMCPServer.run_sse() / launch_tools_mcp_server(transport=&#34;sse&#34;) binds to 0.0.0.0 by default and builds its Starlette application with no authentication middleware and no Origin-header validation. The module mcp/mcp_security.py provides exactly the needed controls (origin validation, DNS-rebinding detection, auth-header enforcement, a SecurityConfig), but none of these functions are ever called by any transport — they are dead code. Any host that can reach the port can list and invoke every registered tool with no credentials, and a victim&#39;s browser can drive the same calls against a localhost instance via DNS rebinding.</p> <p>Affected code: src/praisonai-agents/praisonaiagents/mcp/mcp_server.py - run_sse defaults host to all interfaces (line 245) and builds the app with only `debug` and `routes` - no `middleware=` and no per-route auth/origin gate (lines ~271-289): app = Starlette(debug=self._debug, routes=[ Route(sse_path, endpoint=handle_sse), # &#34;/sse&#34; Mount(messages_path, app=sse_transport.handle_post_message), # &#34;/messages/&#34; ]) uvicorn.run(app, host=host, port=port) - launch_tools_mcp_server also defaults host=&#34;0.0.0.0&#34; (line 301).</p> <p>src/praisonai-agents/praisonaiagents/mcp/mcp_security.py defines but the transports never call: - is_valid_origin (line 30), is_potential_dns_rebinding (line 110), validate_auth_header (line 167), SecurityConfig.is_origin_allowed (line 236). The…</p> https://vulnerability.circl.lu/vuln/ghsa-x227-pf99-vffg