Unauthenticated RCE in PraisonAI's MCP UI endpoint: POST /api/mcp/connect takes a caller-supplied command
NVD·high signal
CVE-2026-57124, published 2026-09-14, scores 9.8. PraisonAI's default UI host applications expose POST /api/mcp/connect without mandatory authentication and pass caller-controlled `command` and `args` to StdioMCPClient, which starts a local process. Because the UI binds to 0.0.0.0 by default, any reachable client executes commands as the UI service account even when the MCP handshake later fails. Fixed in 4.6.59.