PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server

Summary The PraisonAI MCP server exposes an HTTP-stream transport praisonai mcp serve --transport http-stream that binds to localhost and, by default, has no API key. Its only access control for browser-originated requests is an Origin allowlist, which the code implements as required by the MCP...

GHSA-PVPH-5J39-V8QC PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server

Summary The PraisonAI MCP server exposes an HTTP-stream transport praisonai mcp serve --transport http-stream that binds to localhost and, by default, has no API key. Its only access control for browser-originated requests is an Origin allowlist, which the code implements as required by the MCP...

CVE-2026-55532

PraisonAI is a multi-agent teams system. Prior to version 4.6.58 , the MCP HTTP Stream _validate_origin function uses request_origin.startswith(allowed), which allows an attacker-controlled origin such as localhost.attacker.com to satisfy a localhost allowlist entry. This enables an unauthenticat...

CVE-2026-55532 PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream validateorigin uses requestorigin.startswithallowed, allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests...

CVE-2026-55532 PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream validateorigin uses requestorigin.startswithallowed, allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests...

EUVD-2026-65544

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream validateorigin uses requestorigin.startswithallowed, allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests...

GHSA-WJ6G-V78P-6FX3 PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server

Summary PraisonAI's MCP HTTP Stream transport uses an unsafe prefix match when validating the Origin header. The default localhost allowlist includes origins such as http://localhost, and the validation accepts any origin that starts with an allowed value. As a result, an attacker-controlled orig...

PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server

Summary PraisonAI's MCP HTTP Stream transport uses an unsafe prefix match when validating the Origin header. The default localhost allowlist includes origins such as http://localhost, and the validation accepts any origin that starts with an allowed value. As a result, an attacker-controlled orig...

Duplicate Advisory: Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9ccq-2jfg-qw33. This link is maintained to preserve external references. Original Description Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer and Pages::referrerRoute methods,...

GHSA-QH7H-6C7G-X8M6 Duplicate Advisory: Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9ccq-2jfg-qw33. This link is maintained to preserve external references. Original Description Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer and Pages::referrerRoute methods,...

CVE-2026-72702

Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer and Pages::referrerRoute methods, which validate the Referer header using an unanchored string prefix match strstartswith$referrer, $base with no trailing delimiter. An attacker who controls a domain that begins with...

CVE-2026-72702 Grav CMS before 2.0.16 Origin Validation Bypass via Referer

Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer and Pages::referrerRoute methods, which validate the Referer header using an unanchored string prefix match strstartswith$referrer, $base with no trailing delimiter. An attacker who controls a domain that begins with...

CVE-2026-72702

Grav CMS versions before 2.0.16 contain an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods. The root cause is an unanchored string prefix match (str_starts_with($referrer, $base)) with no trailing delimiter, meaning an attacker who controls a domain that begins ...

CVE-2026-72702 Grav CMS before 2.0.16 Origin Validation Bypass via Referer

Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer and Pages::referrerRoute methods, which validate the Referer header using an unanchored string prefix match strstartswith$referrer, $base with no trailing delimiter. An attacker who controls a domain that begins with...

PT-2026-81145

Name of the Vulnerable Software and Affected Versions Grav CMS versions prior to 2.0.16 Description An origin validation bypass exists in the Uri::referrer and Pages::referrerRoute methods. The issue occurs because the Referer header is validated using an unanchored string prefix match via str...

CVE-2026-72921 SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths

SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filerserverhandlers.go allowedprefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup,...

bpf: Allow LPM map access from sleepable BPF programs

...

CVE-2026-64352 bpf: Allow LPM map access from sleepable BPF programs

In the Linux kernel, the following vulnerability has been resolved: bpf: Allow LPM map access from sleepable BPF programs trielookupelem annotates its rcudereferencecheck walks with only rcureadlockbhheld. Because rcudereferencecheckp, c resolves to "c || rcureadlockheld", this passes for XDP/NAP...

CVE-2026-64352 bpf: Allow LPM map access from sleepable BPF programs

In the Linux kernel, the following vulnerability has been resolved: bpf: Allow LPM map access from sleepable BPF programs trielookupelem annotates its rcudereferencecheck walks with only rcureadlockbhheld. Because rcudereferencecheckp, c resolves to "c || rcureadlockheld", this passes for XDP/NAP...

CVE-2026-64352

In the Linux kernel, the following vulnerability has been resolved: bpf: Allow LPM map access from sleepable BPF programs trielookupelem annotates its rcudereferencecheck walks with only rcureadlockbhheld. Because rcudereferencecheckp, c resolves to "c || rcureadlockheld", this passes for XDP/NAP...