PraisonAI MCP Server Origin Validation Bypass via DNS Rebinding-Style Prefix Match (CVE-2026-55529)

Technical Analysis

The vulnerability is a classic same-origin/allowlist bypass caused by using string-prefix matching (request_origin.startswith(allowed)) instead of exact origin comparison. Because 'localhost.evil.example' starts with the substring 'localhost', it satisfies the allowlist check even though it is a completely different, attacker-controlled origin. This enables a cross-site WebSocket/HTTP hijacking (CSWSH)-style attack: a victim simply browsing a malicious webpage causes their browser to issue cross-origin requests to the locally running MCP server (typically bound to localhost), which the server incorrectly trusts. Since no API key is required when origin validation passes, the attacker's page can invoke tools/call and execute any tool exposed by the local MCP server, potentially achieving code execution, data exfiltration, or further pivoting depending on what tools are registered (filesystem, shell, network access, etc.). This crosses the browser-to-local-agent trust boundary, turning a passive web visit into unauthenticated command execution against a locally trusted multi-agent system.

Affected Systems

PraisonAI; protocols: MCP

Detection Signatures

• Origin header matching pattern 'localhost*' via prefix/startswith rather than exact match
• Unexpected inbound HTTP requests to localhost MCP server ports (e.g., typical MCP HTTP stream ports) originating from browser Referer/Origin headers not equal to 'http://localhost' or 'https://localhost' exactly
• Logged tools/call requests without accompanying API key/auth header
• Origin header values containing subdomains appended to 'localhost' or '127.0.0.1' (e.g., localhost.attacker.com, 127.0.0.1.evil.tld)
• Unusual outbound traffic following tool invocation not tied to any legitimate application logic

Remediation Steps

1. 1

   Upgrade PraisonAI

   Update to praisonai version 4.6.58 or later, which fixes the origin validation logic.

2. 2

   Enforce exact origin matching

   Ensure MCP server origin validation uses exact string equality or a properly parsed hostname/port comparison instead of substring or prefix matching.

3. 3

   Require API key authentication

   Configure the MCP HTTP Stream server to always require an API key or bearer token for tools/call requests, regardless of origin, removing implicit trust based on Origin header alone.

4. 4

   Bind to loopback and restrict network exposure

   Ensure MCP servers are bound only to localhost/127.0.0.1 and not exposed to broader network interfaces, reducing the attack surface for cross-origin exploitation.

5. 5

   Audit exposed tools

   Review which tools are registered with the MCP server and minimize exposure of high-privilege tools (filesystem, shell execution, network access) that could be abused if origin checks are bypassed.