CVE-2026-57124CWE-306CWE-78command-injection

CVE-2026-57124

Critical · published September 14, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
63.6
In the wild
Unconfirmed
What it is

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands bind to 0.0.0.0 by default, a reachable unauthenticated client can execute commands as the UI service account even when the MCP handshake later fails. This vulnerability is fixed in 4.6.59.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01035 · 63.6th percentile
Weaknesses
CWE-306 · Missing Authentication for Critical Function; CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-09-14T20:17Z
References (4)
https://github.com/MervinPraison/PraisonAI/commit/2adfe7e8323f6deec66925cf15a885b6238895e9 · [email protected]https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.59 · [email protected]https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-p75f-6fp4-p57w · [email protected]https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-p75f-6fp4-p57w · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 16 SEP 04:29Z
    EPSS moved — → 1%
    epss
  • 14 SEP 15:04Z
    PraisonAI UI MCP connect endpoint allows unauthenticated local command execution
    cvelistv5