PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in

🗓️ 23 Jul 2026 11:41:41Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 4 Views

MCP SSE exposes tools on all interfaces with no auth or origin checks; SecurityConfig unused.

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2026-57123	20 Jul 202622:36	–	circl
CVE	CVE-2026-57123	18 Jun 202613:55	–	cve
Github Security Blog	PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in	18 Jun 202613:55	–	github
OSV	GHSA-X227-PF99-VFFG PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in	18 Jun 202613:55	–	osv
OSV	PYSEC-2026-3536 PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in	23 Jul 202611:41	–	osv
Positive Technologies	PT-2026-61777	18 Jun 202600:00	–	ptsecurity
Positive Technologies	PT-2026-64136	23 Jul 202600:00	–	ptsecurity
Snyk	Binding to an Unrestricted IP Address	18 Jun 202613:55	–	snyk
vulnersOsv	composio-praisonai (>=0.3.24 <=0.7.20), praisonai (>=0.0.34 <=4.6.52) +9 more potentially affected by CVE-2026-57123 via praisonaiagents (=1.6.52)	18 Jun 202613:55	–	vulnersosv

Vulners

Node

Source	Link
github	www.github.com/MervinPraison/PraisonAI/security/advisories/GHSA-x227-pf99-vffg
github	www.github.com/MervinPraison/PraisonAI
pypi	www.pypi.org/project/praisonaiagents
github	www.github.com/advisories/GHSA-x227-pf99-vffg
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-57123

23 Jul 2026 14:32Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.19.8