CVE-2026-61427 describes an improper input validation and authentication bypass vulnerability in MervinPraison's PraisonAI prior to version 4.6.78. The MCP HTTP-stream transport interface is exposed without authentication by default because the CLI --api-key option defaults to None. Without an API key configured, the server does not enforce Authorization/Bearer token checks, allowing unauthenticated clients to initialize sessions, list available tools, and invoke tools. Additionally, the dispatcher forwards tool-call arguments to handlers without validating them against the input schema, potentially allowing malformed or unexpected input. The server binds to 127.0.0.1 by default, limiting remote exploitation unless the operator explicitly binds to a network-accessible interface such as 0.0.0.0.

An unauthenticated attacker on a network-accessible interface can interact with the PraisonAI MCP HTTP-stream transport to enumerate and invoke tools without authorization. Improper input validation may allow malformed inputs to reach tool handlers, potentially leading to unintended behavior or further exploitation. However, by default, the server binds only to localhost, limiting exposure to local users unless configured otherwise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Operators should ensure that the server is not bound to network-accessible addresses unless necessary. Configuring an API key with the --api-key option will enforce Authorization/Bearer token checks and prevent unauthenticated access. Until an official fix is available, avoid running the MCP HTTP-stream transport without authentication and avoid binding to 0.0.0.0 or other public interfaces.