PraisonAI, a multi-agent teams system, has a vulnerability in versions before 1.6.59 where the ToolsMCPServer.run_sse and launch_tools_mcp_server functions bind to 0.0.0.0 and expose /sse and /messages/ routes without applying SecurityConfig authentication, origin-validation, or DNS-rebinding protections. This lack of authentication allows any reachable client to enumerate and invoke registered tools. Because some tools may include file, shell, or code execution capabilities, the impact can be severe. The vulnerability is addressed by patching in praisonaiagents version 1.6.59.

The vulnerability allows unauthenticated remote attackers to access and invoke critical functions exposed by the praisonaiagents server, potentially leading to full confidentiality, integrity, and availability compromise (CVSS 9.8). Attackers can list and execute registered tools, including those capable of file manipulation, shell access, or code execution. This can result in complete system compromise or unauthorized control over the affected system.

Upgrade praisonaiagents to version 1.6.59 or later, where the issue is fixed. This update ensures that SecurityConfig authentication, origin-validation, and DNS-rebinding protections are properly enforced on the affected routes. No other mitigation is indicated by the vendor advisory.