AdvisoriesToolsStatsChecklistSubmitGet the email
← All advisories
CVE-2026-57123criticalBroken access control2026-09-14

CVE-2026-57123: praisonaiagents MCP SSE server exposes every tool with no auth

Before praisonaiagents 1.6.59, ToolsMCPServer.run_sse() and launch_tools_mcp_server(transport="sse") bind to 0.0.0.0 with no authentication or Origin check. Anyone who can reach the port can list and run every registered tool, and a web page can drive a localhost instance through DNS rebinding. The library's own security controls were never wired in.

01.

What it is

run_sse and launch_tools_mcp_server default host to all interfaces and build the Starlette app for /sse and /messages/ with no auth middleware and no Origin validation.

mcp/mcp_security.py defines origin validation, DNS-rebinding detection, auth-header checks and SecurityConfig, but no transport calls them. The impact depends on the registered tools; file, shell and code-execution tools mean full compromise of the host.

02.

How to check

  1. Affected: praisonaiagents (PyPI) before 1.6.59 (the GitHub advisory lists 1.6.52 and earlier as vulnerable).
  2. Check whether you start an MCP server with transport="sse" through ToolsMCPServer or launch_tools_mcp_server.
03.

How to fix

  1. Upgrade praisonaiagents to 1.6.59 or later.
  2. Bind MCP servers to 127.0.0.1 unless you really need remote access, and put remote ones behind authentication.
pip show praisonaiagents | grep -i version
04.

Sources

More advisories for this tool
The weekly email

One email a week. Only what changed.

Every new security hole in AI coding tools, MCP servers, app builders and the stacks they generate (Next.js, Supabase, Node, PHP), each with how to check your app and the fix. No roundups of things you already read.

Free, one email a week. Read the latest issue first if you like. One-click unsubscribe in every email. We never sell or share addresses.