CVE-2026-55532: CWE-346: Origin Validation Error in MervinPraison PraisonAI

PraisonAI versions before 4.6.58 have a flaw in the MCP HTTP Stream _validate_origin function where the origin check uses request_origin.startswith(allowed), permitting origins such as localhost.attacker.com to bypass the localhost allowlist. This allows an attacker-controlled webpage to send Content-Type: text/plain requests without CORS preflight and invoke the tools/call endpoint without requiring an API key. The vulnerability enables unauthorized file writes that persist agent instructions. The issue is addressed in version 4.6.58.

An attacker can bypass origin validation to send unauthorized HTTP requests that do not require an API key, potentially leading to unauthorized file writes that persist agent instructions. This can result in partial confidentiality loss, high integrity impact due to unauthorized modifications, and low availability impact. The CVSS score is 7.6 (high severity).

Upgrade PraisonAI to version 4.6.58 or later, where the origin validation logic is corrected to prevent bypass via startswith checks. No other mitigation is indicated by the vendor advisory.