CVE-2026-55532

PraisonAI is a multi-agent teams system. Prior to version 4.6.58 , the MCP HTTP Stream _validate_origin function uses request_origin.startswith(allowed), which allows an attacker-controlled origin such as localhost.attacker.com to satisfy a localhost allowlist entry. This enables an unauthenticat...