CyberRota Analysis
AI-GeneratedPraisonAI versions prior to 4.6.59 are vulnerable due to an unauthenticated POST endpoint that allows remote attackers to execute arbitrary commands on the server as the UI service account. This critical flaw, which binds to 0.0.0.0 by default, poses a severe risk as it enables unauthorized command execution even if subsequent authentication attempts fail. Organizations using affected versions should prioritize immediate updates to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands bind to 0.0.0.0 by default, a reachable unauthenticated client can execute commands as the UI service account even when the MCP handshake later fails. This vulnerability is fixed in 4.6.59.