CVE-2026-57124criticalCWE-306CWE-78

CVE-2026-57124: critical vulnerability in MervinPraison PraisonAI

PraisonAI UI MCP connect endpoint allows unauthenticated local command execution

Published

Follow this CVE+ Monitor PraisonAI+ Monitor praisonai

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 1.0%
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands bind to 0.0.0.0 by default, a reachable unauthenticated client can execute commands as the UI service account even when the MCP handshake later fails. This vulnerability is fixed in 4.6.59.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
MervinPraison · PraisonAI
Related CVEs — MervinPraison PraisonAI

In the same product, most dangerous first.

CVE-2026-44338HIGHPraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow executionEPSS 32.6%CVE-2026-61447CRITICALPraisonAI before 1.6.78 Remote Code Execution via CodeAgentEPSS 15.2%CVE-2026-34938CRITICALPraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_codeEPSS 13.4%CVE-2026-48168CRITICALPraisonAI: GitHub Actions Claude workflow command injection via unquoted PR branch nameEPSS 1.5%CVE-2026-47391CRITICALPraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool executionEPSS 1.5%CVE-2026-57131CRITICALpraisonai: Jobs API exposes agent-execution endpoints with no authenticationEPSS 1.0%