CVE-2026-61427: PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface

In mcp_server/transports/http_stream.py, the Authorization check sits inside if self.api_key:, and _validate_origin returns true when the Origin header is absent, so curl or Burp are not blocked. In server.py, _handle_tools_call calls tool.handler(**arguments) with attacker-supplied arguments and no schema check. Only the handler's Python signature rejects unknown keys. The reporter saw got an unexpected keyword argument '__undeclared_evil_param__'.

The server binds to 127.0.0.1 by default, so exposure is any local process or other user on a shared host, and remote clients if the operator passes --host 0.0.0.0. An attacker can enumerate tools, then use whichever work to burn LLM API keys and cost, or reach data. The reporter found no unauthenticated code execution or file read in 4.6.63, because workflow.run and workflow.run_file fail with a missing config_list. Other adapters error too. Later versions may differ, so the real impact depends on which tools work in your build.

Affected: praisonai 4.6.77 and earlier, when you run praisonai mcp serve --transport http-stream without --api-key. The research was done on 4.6.63.

pip show praisonai
ps aux | grep "mcp serve"

Check startup scripts and container commands for the serve command and for --host.

Upgrade to praisonai 4.6.78:

pip install --upgrade praisonai

The sources do not describe the code change. Until you upgrade, always start the server with --api-key, keep the default loopback bind, and do not use --host 0.0.0.0 without a reverse proxy that requires authentication.

Check server logs for initialize and tools/list requests from clients that sent no Authorization header, and for tools/call requests with unexpected argument names, which produce unexpected keyword argument errors. Run ss -ltnp to see whether the MCP port listens on anything other than 127.0.0.1. Review LLM provider usage for unexplained spikes.

Summary

PraisonAI's MCP HTTP-stream server authenticates requests only when an API key is configured; the CLI defaults --api-key to None, so praisonai mcp serve --transport http-stream exposes the full MCP surface unauthenticated. A request with no Authorization (and no Origin) can initialize and tools/list (~50 tools), and the dispatcher forwards tool-call arguments to handlers without validating them against the advertised inputSchema. Runtime-confirmed for unauthenticated initialize/tools/list and the dispatcher schema-bypass. This is not an RCE/file-read in 4.6.63 — workflow.run/workflow.run_file are runtime-refuted (adapter regression). Severity Medium–High.

Details

Affected component

• Package: praisonai 4.6.63. Files: src/praisonai/praisonai/mcp_server/transports/http_stream.py, mcp_server/cli.py, mcp_server/server.py (dispatcher).

Vulnerable code / root cause

Path: src/praisonai/praisonai/mcp_server/transports/http_stream.py

Function: mcp_post / _validate_origin

Snippet:

if self.api_key:                       # auth applied ONLY when api_key is set
    auth_header = request.headers.get("Authorization", "")
    if not auth_header.startswith("Bearer ") or auth_header[7:] != self.api_key:
        return JSONResponse({"error": "Unauthorized"}, status_code=401)
# _validate_origin: returns True when the Origin header is absent

Issue: with api_key=None, no auth check runs; a missing Origin header is allowed, so non-browser clients (curl/Burp) are not blocked.

Path: src/praisonai/praisonai/mcp_server/cli.py

Function: cmd_serve (argparse)

Snippet:

parser.add_argument("--api-key", default=None)   # unauthenticated by default

Path: src/praisonai/praisonai/mcp_server/server.py

Function: _handle_tools_call

Snippet:

result = await tool.handler(**arguments)   # arguments forwarded without inputSchema validation

Issue: attacker-controlled arguments are passed straight to the handler; the dispatcher does not validate them against the tool's advertised inputSchema. The only thing rejecting undeclared keys is the handler's own Python signature.

Attack flow

1. Operator runs praisonai mcp serve --transport http-stream (no --api-key).
2. Attacker (no auth, no Origin) sends initialize → session; tools/list → enumerates ~50 tools; tools/call → arguments pass through unvalidated.

Why existing protection is bypassed

Auth is opt-in (only added when an api key is set); missing Origin is allowed; the dispatcher does not enforce inputSchema.

Security boundary

Unauthenticated access to the MCP tool surface. Default bind 127.0.0.1 (any local process / multi-user host; remote only if --host 0.0.0.0).

Scope limits (do not overclaim)

• praisonai.workflow.run / workflow.run_file are runtime-refuted in 4.6.63: the adapter calls AgentsGenerator(...) missing the required config_list argument → errors before any execution/file open. Several other tool adapters also error at runtime. No unauthenticated RCE/arbitrary-file-open via these tools at HEAD.
• MCP knowledge.add file read is broken (see FT-01_Knowledge_FileRead_Negative_Report.md).

Proof of Concept

Environment

Real MCP HTTP-stream server (api_key=None) in a local runtime (127.0.0.1:18090). Runnable assets: PraisonAI-Runtime-Repro\runtime-files\ (docker-compose.mcp.yml). MCP requests use Accept: application/json + header Mcp-Session-Id.

Steps to reproduce

1. MCP-Initialize: POST /mcp initialize (no Authorization) → 200 + mcp-session-id.
2. MCP-Tools-List-NoAuth: POST /mcp tools/list with that session id → 200 + ~50 tools.
3. MCP-Schema-Bypass: tools/call with an undeclared extra argument (__undeclared_evil_param__).

Expected result

The transport requires authentication; the dispatcher validates arguments against inputSchema.

Actual result

• initialize/tools/list succeed with no auth and no Origin header.
• The undeclared argument reaches the handler (got an unexpected keyword argument '__undeclared_evil_param__'), proving no schema validation at the dispatcher.

Screenshots

Screenshots

Unauthenticated MCP initialize

A POST request to /mcp with method initialize succeeds without an Authorization header. The server returns HTTP 200 OK, exposes MCP capabilities, and issues an mcp-session-id to the unauthenticated client.

Unauthenticated MCP tools/list

After initialization, the same unauthenticated MCP session can call tools/list using only the issued Mcp-Session-Id. The server returns HTTP 200 OK and exposes tool names, schemas, and annotations.

MCP tool-call schema bypass

The unauthenticated MCP client calls tools/call with an extra argument not declared in the tool schema. Instead of rejecting the schema-violating input at the dispatcher layer, the unexpected parameter reaches the Python handler and causes an unexpected keyword argument error. This confirms incomplete input-schema enforcement for tool calls.

Impact

Unauthenticated tool enumeration and tool-call surface; LLM-key/cost abuse and data access via whichever tools function (impact currently limited by several broken adapters and the default loopback bind). No confirmed unauthenticated RCE/file-read in 4.6.63.