PraisonAI Validated MCP Origins With startswith, So localhost.attacker.com Passed the Allowlist

GitHub Security Advisories·high signalXBlueskyLinkedInCopy link

CVE-2026-55532 (7.6 HIGH) and CVE-2026-55529 (6.9), published 2026-08-25, cover PraisonAI's MCP HTTP Stream `_validate_origin`, which used `request_origin.startswith(allowed)` against a localhost allowlist. An attacker-registered `localhost.attacker.com` satisfies the prefix, and because the requests go out as `Content-Type: text/plain` there is no preflight, so any webpage you visit can call `tools/call` on your local MCP server without an API key, including file writes that persist into agent state. A third bug in the same release, CVE-2026-55531, lets an unauthenticated caller exhaust memory by spamming `initialize`. Fixed in 4.6.58.