CVE-2026-57139

9.8 Critique

Publiée le 15/09/2026 à 13:17 · Modifiée le 17/09/2026 à 17:16 · Analyse NVD reportée · Source : security-advisories@github.com

Description

PraisonAI is a multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp() in src/praisonai-ts/src/mcp/server.ts binds without a host restriction and forwards every HTTP POST request to handleRequest() without authentication or authorization. Any network client that can reach the port can call tools/list, tools/call, resources/read, or prompts/get, causing registered handlers to run with server-side credentials and process privileges or disclose registered data. An initial remediation was released in version 1.7.2.

Traduire en français

Produits concernés

MervinPraison PraisonAI

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.8 Critique	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-306
CWE-862
CWE-1188

Références

https://github.com/MervinPraison/PraisonAI/commit/709a0387853709a5e2f2c34680fa64cada252c27
https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.60
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-j4f3-55x4-r6q2
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-j4f3-55x4-r6q2

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories