GHSA-pvph-5j39-v8qc: PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server

Summary

The PraisonAI MCP server's HTTP-stream transport, started with praisonai mcp serve --transport http-stream, validates Origin with a startswith prefix match against http://localhost and http://127.0.0.1. An attacker can therefore host a page on a hostname such as localhost.attacker.com, and when a victim visits it, the server accepts and executes unauthenticated cross-site requests, including a tools/call that creates a rule file with activation "always" to inject persistent prompt instructions into later agent runs. The request can be sent as a CORS simple request with Content-Type: text/plain, requiring no preflight, and no session is needed for tools/call. This is a blind CSRF against a local agent runtime.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Topics

• Model Context Protocol

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
• InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
• MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online