Unrated

Unauthenticated OS Command Injection in PraisonAI UI MCP Connect Endpoint

IdentifiersCVE-2026-57124CWE-78

CVE-2026-57124 is a vulnerability in PraisonAI UI affecting the MCP connect endpoint. The issue combines missing authentication on MCP management functionality with operating system command injection in the endpoint used to initiate MCP stdio connections. A remote attacker can send a crafted POST request to the MCP connect API and influence the command and arguments used to launch local processes, causing the application to start attacker-chosen processes on the host. The vulnerability results in arbitrary command execution in the security context of the PraisonAI UI service.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows remote unauthenticated attackers to execute arbitrary local commands as the PraisonAI UI service user. This can enable theft of application secrets and local data, modification or deletion of files, installation of persistence mechanisms, abuse of the host for follow-on activity, and disruption of the PraisonAI UI service or underlying system processes.

Mitigation

If you can’t patch tonight, do this now.

Do not expose PraisonAI UI host applications to untrusted networks until patched. Bind the UI to localhost rather than all interfaces where possible, disable or tightly restrict MCP connect functionality, and require authentication and authorization for MCP management endpoints. If external exposure is unavoidable, place the service behind strong access controls and network filtering to limit who can reach the vulnerable functionality.

Remediation

Patch, then assume compromise.

Upgrade praisonai to version 4.6.59 or later. In addition to patching, the vulnerable design should be corrected by removing remote caller control over command and argument selection for MCP stdio launches, enforcing authentication on MCP management routes by default, and avoiding unsafe external exposure of the UI service.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

PraisonAIPraisonaiapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

1 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1