PraisonAI MCPServer Unauthenticated HTTP tools/call Authentication Bypass (GHSA-j4f3-55x4-r6q2)

How the attack works

An attacker sends a JSON-RPC request (tools/call, tools/list, resources/read, or prompts/get) directly to the MCP server's HTTP endpoint. They either omit the Authorization header entirely or send an obviously invalid one like 'Bearer invalid'. Because the server's handleRequest() function never calls its own MCPSecurity manager, the request is processed anyway. The server returns HTTP 200 and executes the requested tool as if the caller were authorized.

Netzilo detection

Why it matters

Anyone who can reach the exposed MCP endpoint can invoke registered tools, read resources, or pull prompts without any credentials — effectively full unauthenticated access to whatever capabilities the server exposes.

What you can do

• →Upgrade praisonai to 1.7.2 or later, which fixes the missing authentication check.
• →Until patched, do not expose the MCPServer's HTTP endpoint to untrusted networks; restrict access with a firewall or place it behind a reverse proxy that enforces authentication.
• →Audit logs for tools/call, tools/list, resources/read, or prompts/get requests with missing or invalid Authorization headers.
• →Treat any tool executions that occurred before patching as potentially attacker-triggered and review what those tools could access or modify.

Known benign look-alikes

• Legitimate authenticated MCP client sending a tools/call request with a valid Authorization header.
• MCP protocol documentation describing the tools/call JSON-RPC method without the unauthenticated bypass framing.
• Mitigation advisory recommending an upgrade to praisonai >= 1.7.2 without exploit content.

References

• https://agentthreatrule.org/en/rules/ATR-2026-01949

Related threats