Disclosed vulnerability
PraisonAI multi-agent framework: coordinated September 2026 disclosure of unauthenticated tool/agent execution and sandbox escapes
AIR-2026-0242 AIR record · 2026-09-praisonai-framework-auth-sandbox-cluster
From the supporting source
MCPServer.startHttp() in src/praisonai-ts/src/mcp/server.ts binds without a host restriction and forwards every HTTP POST request to handleRequest() without authentication or authorization.cveawg.mitre.org
The record
Disclosed
2026-09-14
Vendor
MervinPraison
Product
PraisonAI (npm praisonai / praisonai-ts and pip praisonai, praisonaiagents)
Risk domain
Access control and permissions › Confused deputy
Also touches
Privilege escalation
System type
Generative model
Who acted
AI was the target — framework authentication and sandbox flaws; no model decision
Attack surface
Agent framework
Autonomy level
Semi-autonomous
Initial vector
Unauthenticated network request
Impact type
Remote code execution, Sandbox escape, Authorization bypass, Unauthorized tool execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0054 – LLM Jailbreak
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- —
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Validate delegation chains; Use signed attestations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
PraisonAI < 4.6.59 / praisonaiagents < 1.6.59 and praisonai-ts codeMode/MCPServer 1.4.0-1.7.1; HTTP/SSE/Jobs surfaces bind 0.0.0.0 by default
Capability abused
Defense & remediation
Recorded defense
bundled MCPSecurity / SecurityConfig / @require_approval and codeMode source blocklist (none wired into the vulnerable paths)
Guardrail kinds
Human approval, Permission scope
Guardrail outcome
Silent
Fix shipped
praisonai 4.6.58/4.6.59, praisonaiagents 1.6.59, praisonai-ts 1.7.2
Taxonomy & references
Curator notes
UMBRELLA record for the coordinated Sept 2026 PraisonAI disclosure batch (all CVSS 9.8-9.9, published 2026-09-14/15). Fused per the corpus umbrella precedent (cf. AIR-2026-0089 'MCP by Design' bundling a dozen CVEs) because they share one framework and root theme: security controls exist in the codebase but are never wired into the HTTP/SSE/MCP/Jobs execution paths, plus a codeMode 'sandbox' that is only a source blocklist. Mechanisms: 57138 codeMode Function-constructor escape; 57139 MCPServer unauth tools/call; 57123 SSE bind 0.0.0.0 no auth/origin; 57124 /api/mcp/connect unauth local command; 57125 Jobs API unauth RCE + approve-field approval bypass; 57127 auth middleware silently disabled when no secret set; 57131 Jobs API no auth. Reporters include rexpository, vndasunkid and others. Related same-batch CVE-2026-57122 (webhook HMAC bypass, 8.6) and CVE-2026-57124's twin 57123 also disclosed. All responsible disclosure, PoC-level, no real victim.
Supporting sources
- https://cveawg.mitre.org/api/cve/CVE-2026-57139
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-j4f3-55x4-r6q2
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vmmj-pfw7-fjwp
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4869-x4pr-q22x
- https://cvebrief.com/archive/2026/09/16/
Cite as
Enkrypt AI. "PraisonAI multi-agent framework: coordinated September 2026 disclosure of unauthenticated tool/agent execution and sandbox escapes". AIR, AIR-2026-0242. https://agentincident.vercel.app/i/AIR-2026-0242/ (accessed 2026-10-19).