CVE-2026-55532
Summary
The PraisonAI MCP server exposes an HTTP-stream transport (praisonai mcp serve --transport http-stream) that binds to localhost and, by default, has no API key. Its only access control for browser-originated requests is an Origin allowlist, which the code implements as required by the MCP 2025-11-25 security guidance. The allowlist check uses a prefix match (request_origin.startswith(allowed)), so any Origin whose string begins with http://localhost or http://127.0.0.1 is accepted, for example http://localhost.attacker.com. An attacker who registers such a hostname and serves a page from it can, when a victim visits the page, issue cross-site requests that the MCP server accepts and executes without authentication. Because the request can be sent as a CORS "simple request" (Content-Type: text/plain, which the server still parses as JSON), it requires no preflight, and because tools/call does not require a session, a single forged request executes an MCP tool. This is a blind cross-site request forgery against a developer's local agent runtime. A natural end-to-end impact is persistent prompt injection: the forged request creates a rule file that the agent runtime loads with activation "always", so attacker-controlled instructions are injected into every subsequent agent run on the victim's machine.
Details
The HTTP-stream transport validates the Origin header in transports/http_stream.py. The allowlist is built for a localhost bind, then matched with startswith:
init: default allowlist when binding to localhost
self.allowed_origins = ["http://localhost", "http://127.0.0.1",
"https://localhost", "https://127.0.0.1"]
def _validate_origin(self, request_origin):
if request_origin is None:
return True # no Origin -> allowed
if self.allowed_origins is None:
return False
for allowed in self.allowed_origins:
if request_origin == allowed or request_origin.startswith(allowed):
return True # prefix match: the bypass
return False
"http://localhost.attacker.com".st
⚡ Watch CVE-2026-55532
Get an email if CVE-2026-55532 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-55532)