Technical impact
PraisalAI before version 4.6.78 exposes its MCP HTTP-stream transport without an authentication requirement by default. Because the CLI --api-key option defaults to None, the server only performs Authorization/Bearer checks when an API key is explicitly configured. As a result, an unauthenticated client that connects to the HTTP-stream endpoint can create a session, enumerate the available tools (tools/list) and invoke any tool (tools/call). In addition, the dispatcher forwards tool-call arguments to handlers without validating them against the advertised inputSchema, creating a CWE-20 Improper Input Validation flaw that could allow arbitrary tool execution.
Affected Systems
All releases of PraisonAI offered by MervinPraison before 4.6.78 are affected. The service defaults to binding on 127.0.0.1, making the flaw locally exploitable. However, if an operator configures the server to listen on a network‑accessible interface (such as --host 0.0.0.0), the vulnerability becomes remotely exploitable.
Risk and Exploitability
This issue has a CVSS score of 6.9, indicating moderate severity. The EPSS score is reported as <1%, implying a very low but non‑zero probability of exploitation. The flaw is not listed in the CISA KEV catalog. Because authentication is bypassed and the input payload is not validated, a successful exploit could enable an unauthenticated attacker to execute arbitrary tool functions and pose a threat to system integrity when the service is exposed externally.
Github GHSA