CVE-2026-57139: Praisonai Npm PraisonAI MCPServer Exposes Unauthenticated Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-j4f3-55x4-r6q2",
  "modified" : "2026-07-20T21:27:31Z",
  "published" : "2026-06-18T14:26:48Z",
  "aliases" : [ "CVE-2026-57139" ],
  "summary" : "npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call",
  "details" : "## Summary\n\nThe published npm package `praisonai` exports a TypeScript `MCPServer` that can expose tools, resources, and prompts over an HTTP JSON-RPC transport with:\n\n```ts\nawait server.start({ port: 3000 });\n```\n\nThe HTTP transport has no authentication or authorization path. `MCPServerConfig` does not expose an auth/security setting, `startHttp()` ignores the `Authorization` header, and every POST request is parsed and forwarded directly to `handleRequest()`. That request handler dispatches sensitive MCP methods such as `tools/call`, `resources/read`, and `prompts/get`.\n\nThe implementation also calls `this.httpServer.listen(port)` without a host argument. In Node.js this binds to the unspecified address; the local PoV observed `{ address: \"::\", family: \"IPv6\" }`, making the service reachable on all interfaces on systems where the port is exposed.\n\nThis lets any network client that can reach the HTTP port list tools and invoke registered server-side tools without credentials. Supplying `Authorization: Bearer invalid` makes no difference.\n\n## Technical Details\n\n`MCPServerConfig` exposes server metadata, tools/resources/prompts, stdio, port, and logging. It does not expose an auth token, authorization policy, `MCPSecurity` instance, authorization callback, or loopback-only option:\n\n```text\nsrc/praisonai-ts/src/mcp/server.ts\n  57: export interface MCPServerConfig {\n  63:     tools?: MCPServerTool[];\n  65:     resources?: MCPResource[];\n  67:     prompts?: MCPPrompt[];\n  69:     stdio?: boolean;\n  73:     port?: number | null;\n  75:     logging?: boolean;\n```\n\n`handleRequest()` dispatches sensitive MCP methods directly:\n\n```text\nsrc/praisonai-ts/src/mcp/server.ts\n  203: async handleRequest(request: MCPRequest): Promise<MCPResponse> {\n  219:     case 'tools/call':\n  220:       result = await this.handleToolCall(params);\n  225:     case 'resources/read':\n  226:       result = await this.handleResourceRead(params);\n  231:     case 'prompts/get':\n  232:       result = await this.handlePromptGet(params);\n```\n\nThe tool dispatcher invokes the registered handler:\n\n```text\nsrc/praisonai-ts/src/mcp/server.ts\n  285: private async handleToolCall(params?: any): Promise<any> {\n  288:   const tool = this.tools.get(name);\n  298:   const result = await tool.handler(args ?? {});\n```\n\nThe HTTP server parses every POST body and forwards it to `handleRequest()` with no authentication check:\n\n```text\nsrc/praisonai-ts/src/mcp/server.ts\n  403: async startHttp(port: number): Promise<void> {\n  409:   this.httpServer = http.createServer(async (req, res) => {\n  416:     const response = await this.handleRequest(request);\n  434:   this.httpServer.listen(port, () => {\n```\n\nThis is a guard-coverage gap because the same TypeScript package already ships a dedicated MCP security manager:\n\n```text\nsrc/praisonai-ts/src/mcp/security.ts\n  2:  * MCP Security - Authentication, authorization, and rate limiting\n  79: export class MCPSecurity {\n  132: async check(request: { path?: string; method?: string; headers?: ... })\n  167: const auth = headers['authorization'] ?? headers['Authorization'];\n  239: case 'authenticate':\n  303: export function createApiKeyPolicy(...)\n```\n\n`MCPServer` never references that security manager in its HTTP request path.\n\n### Why This Is Not Intended Behavior\n\nPraisonAI's MCP documentation says MCP servers allow AI models to use tools and communicate with external systems. The same page's security considerations say to use API keys in production, implement rate limiting, validate incoming requests, use HTTPS, and limit custom tool permissions.\n\nPraisonAI's security page also documents prior breaking hardening where API servers were changed to require authentication by default and bind to `127.0.0.1` instead of `0.0.0.0`. It separately lists MCP `tools/call` issues as security vulnerabilities.\n\nThe npm TypeScript `MCPServer` does the opposite:\n\n- `start({ port })` binds to the unspecified address;\n- `MCPServerConfig` has no auth/security field;\n- `startHttp()` does not inspect `Authorization`;\n- `tools/list`, `tools/call`, `resources/read`, and `prompts/get` all dispatch without authentication; and\n- `MCPSecurity` exists but is not wired into the HTTP server.\n\nThis is not merely a deployment hardening suggestion. The package exposes an HTTP MCP server API and a separate security manager, but the server's own HTTP transport provides no way to enforce the documented API-key requirement.\n\n## PoV\n\nThe PoV installs the published npm package in a temporary project, starts the exported `MCPServer` on a local ephemeral port, and sends loopback JSON-RPC requests. It does not call any LLM provider or external service after package installation.\n\nRun from a local reproduction checkout:\n\n```fish\nnode poc/pov_poc.js 1.7.1\n```\n\nObserved result:\n\n```json\n{\n  \"package\": \"praisonai\",\n  \"version\": \"1.7.1\",\n  \"mcpServerExported\": true,\n  \"bindAddress\": {\n    \"address\": \"::\",\n    \"family\": \"IPv6\"\n  },\n  \"initialize\": {\n    \"status\": 200\n  },\n  \"list\": {\n    \"status\": 200,\n    \"json\": {\n      \"result\": {\n        \"tools\": [\n          {\n            \"name\": \"admin_reset_marker\",\n            \"description\": \"privileged marker tool\"\n          }\n        ]\n      }\n    }\n  },\n  \"callNoAuth\": {\n    \"status\": 200,\n    \"json\": {\n      \"result\": {\n        \"content\": [\n          {\n            \"text\": \"invoked:NO_AUTH_MARKER\"\n          }\n        ]\n      }\n    }\n  },\n  \"callBadAuth\": {\n    \"status\": 200,\n    \"json\": {\n      \"result\": {\n        \"content\": [\n          {\n            \"text\": \"invoked:BAD_AUTH_MARKER\"\n          }\n        ]\n      }\n    }\n  },\n  \"calls\": [\n    \"NO_AUTH_MARKER\",\n    \"BAD_AUTH_MARKER\"\n  ],\n  \"patchedControl\": {\n    \"noAuthStatus\": 401,\n    \"withAuthStatus\": 200,\n    \"patchedCalls\": [\n      \"called\"\n    ]\n  }\n}\n```\n\nInterpretation:\n\n- unauthenticated `initialize` returns `200`;\n- unauthenticated `tools/list` returns the registered tool;\n- unauthenticated `tools/call` invokes the registered tool;\n- invalid `Authorization: Bearer invalid` is ignored and also invokes the tool;\n- the server binds to the unspecified IPv6 address; and\n- a minimal local wrapper that enforces a bearer token blocks the same no-auth call with `401`, demonstrating that the PoV is exercising the missing authentication boundary.\n\n## PoC\n\nThe PoV section above contains the local reproduction command, input, and decisive output.\n\n## Impact\n\nAny client that can reach the npm TypeScript `MCPServer` HTTP port can list and invoke all registered MCP tools without credentials.\n\nReal impact depends on which tools, resources, and prompts the application registers. MCP tools commonly wrap filesystem operations, API clients, database queries, agent actions, deployment operations, email/Slack actions, browser automation, and code execution. Because those handlers run with the server process privileges and server-side credentials, an unauthenticated caller can drive the same actions.\n\n`resources/read` and `prompts/get` are also unauthenticated and may disclose application data or prompt material registered by the server.\n\n### Severity\n\nSuggested severity: Critical.\n\nRationale:\n\n- `AV`: exploitation is a direct HTTP JSON-RPC request.\n- `AC`: no race, user gesture, or special state is required.\n- `PR`: no credentials are required; invalid credentials are ignored.\n- `UI`: no user interaction is required after the server is running.\n- `S`: impact is within the authority of the MCP server process and its registered tools.\n- `C`: resources, prompts, and tool-returned data may expose sensitive data.\n- `I`: unauthenticated callers can drive server-side tools.\n- `A`: unauthenticated callers can invoke destructive or resource-consuming tools if registered.\n\n## Suggested Fix\n\nRecommended minimum fix:\n\n1. Add `security`, `auth`, `authRequired`, `apiKeys`, or `authorize(req)` to `MCPServerConfig`.\n2. Fail closed for HTTP transport when auth is not configured, unless the caller explicitly opts into unauthenticated loopback-only development mode.\n3. Bind HTTP transport to `127.0.0.1` by default, or require an explicit host when binding to all interfaces.\n4. Call `MCPSecurity.check(...)` or equivalent middleware before every non-health POST request reaches `handleRequest()`.\n5. Return `401` for missing or invalid credentials before dispatching `initialize`, `tools/list`, `tools/call`, `resources/read`, or `prompts/get`.\n6. Add Origin/Host protections for loopback HTTP transports to reduce DNS rebinding exposure.\n7. Add regression tests proving:\n   - no-auth `tools/list` returns `401`;\n   - no-auth `tools/call` returns `401` and does not invoke the handler;\n   - invalid bearer token returns `401`;\n   - valid bearer token invokes the handler;\n   - default `start({ port })` does not bind to all interfaces without an explicit opt-in.\n\n## Affected Package/Versions\n\n- Repository: `MervinPraison/PraisonAI`\n- Ecosystem: `npm`\n- Package: `praisonai`\n- Component: `src/praisonai-ts/src/mcp/server.ts`\n- Related unused security component: `src/praisonai-ts/src/mcp/security.ts`\n- Current npm version checked: `1.7.1`\n- Refreshed `origin/main` checked: `1ad58ca02975ff1398efeda694ea2ab78f20cf3e`\n\nConfirmed affected range:\n\n```text\n>= 1.5.0, <= 1.7.1\n```\n\nBoundary:\n\n```text\n1.4.0 does not export MCPServer and does not ship dist/mcp/server.js.\n```\n\nNo fixed npm version is known at the time of this report.\n\n### Version Sweep\n\nThe included sweep installs selected npm versions and checks the HTTP `MCPServer` path:\n\n```fish\nnode poc/version_sweep_poc.js\n```\n\nObserved result:\n\n```text\n1.4.0: mcpServerExported=false, hasDistMcpServer=false\n1.5.0: mcpServerExported=true, hasDistMcpServer=true, noAuthToolCallInvoked=true, bindAddress=::\n1.5.4: mcpServerExported=true, hasDistMcpServer=true, noAuthToolCallInvoked=true, bindAddress=::\n1.6.0: mcpServerExported=true, hasDistMcpServer=true, noAuthToolCallInvoked=true, bindAddress=::\n1.7.0: mcpServerExported=true, hasDistMcpServer=true, noAuthToolCallInvoked=true, bindAddress=::\n1.7.1: mcpServerExported=true, hasDistMcpServer=true, noAuthToolCallInvoked=true, bindAddress=::\n```\n\n## Advisory History\n\nKnown related public advisories:\n\n- `GHSA-9mqq-jqxf-grvw` / `CVE-2026-44336`: `pip:praisonai` MCP `tools/call` path traversal to RCE in Python `praisonai mcp serve`, affected `<= 4.6.33`.\n- `CVE-2026-47394`: `pip:praisonai` incomplete MCP path traversal fix affecting Python workflow/deploy handlers.\n- poc: deprecated Python MCP SSE Host/Origin/session issue.\n- poc: npm TypeScript AgentOS missing authentication.\n\nThis report is distinct because it targets:\n\n- ecosystem: `npm`;\n- package: `praisonai`;\n- component: `src/praisonai-ts/src/mcp/server.ts`;\n- root cause: TypeScript `MCPServer` HTTP transport missing auth and not using `MCPSecurity`;\n- primitive: unauthenticated and invalid-auth JSON-RPC `tools/call` invokes arbitrary registered TypeScript MCP tools; and\n- affected range: `>= 1.5.0, <= 1.7.1`.\n\nThe Python MCP advisories cover path traversal in specific Python MCP tool handlers. They do not cover the npm TypeScript `MCPServer` transport or its unwired security manager.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "praisonai"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.5.0"
      }, {
        "fixed" : "1.7.2"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.7.1"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-j4f3-55x4-r6q2"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/MervinPraison/PraisonAI"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-1188", "CWE-306", "CWE-862" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-18T14:26:48Z",
    "nvd_published_at" : null
  }
}