PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, ToolsMCPServer.run_sse() in src/praisonai-agents/praisonaiagents/mcp/mcp_server.py mounts SseServerTransport on the legacy /sse and /messages/ endpoints without default Host, Origin, or authentication enforcement. A malicious website can use DNS rebinding against a reachable local or internal SSE server, supply attacker-controlled Host and Origin headers, enumerate registered tools

CVE-2026-57112 affects PraisonAI multi-agent system versions praisonaiagents 0.6.0 to 1.6.59 and PraisonAI 3.10.0 to 4.6.59. The vulnerability exists in ToolsMCPServer.run_sse() which mounts SseServerTransport on legacy /sse and /messages/ endpoints without Host, Origin, or authentication enforcement. An attacker can exploit this via DNS rebinding against a local or internal SSE server to supply malicious Host and Origin headers. This allows enumeration of registered tools and invocation of them with the server user's privileges. The flaw is isolated to the legacy SSE wrapper, as the Streamable HTTP transport correctly rejects hostile Origins. Remediation was released in praisonaiagents 1.6.59 and PraisonAI 4.6.59. Users should upgrade immediately to the patched versions to mitigate the risk of unauthorized tool invocation.