Unrated

Unauthenticated MCPServer HTTP JSON-RPC Access in praisonai

IdentifiersCVE-2026-57139CWE-306

CVE-2026-57139 is an improper authentication vulnerability in the npm package praisonai affecting its TypeScript MCPServer HTTP JSON-RPC interface. The exposed HTTP transport does not enforce authentication or authorization before dispatching sensitive MCP methods, allowing unauthenticated clients to invoke operations such as tools/call, resources/read, and prompts/get. As a result, any reachable client can interact with registered server-side tools and access exposed resources or prompts without credentials. The severity and downstream effect depend on which handlers are registered behind the MCP interface, but the flaw can expose privileged application functionality directly over the network.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an unauthenticated remote client with network reachability to the MCPServer HTTP port to enumerate tools and invoke server-side functionality without authorization. Depending on the configured handlers, this can lead to unauthorized disclosure of application data and prompt material, filesystem or database access, execution of API or deployment actions, browser automation, and potentially arbitrary code execution in the security context of the server process and its available credentials.

Mitigation

If you can’t patch tonight, do this now.

Do not expose the MCPServer HTTP transport to untrusted networks until patched. Restrict access to loopback or tightly controlled internal interfaces, place the service behind an authenticating reverse proxy, and enforce firewall rules or network ACLs so only trusted clients can reach the endpoint. Require strong bearer-token or equivalent authentication before requests are forwarded to the MCP JSON-RPC handler. Reduce risk further by minimizing the set of registered tools, resources, and prompts and avoiding exposure of privileged handlers over this transport.

Remediation

Patch, then assume compromise.

Upgrade praisonai to version 1.7.2 or later. In addition to patching, ensure the HTTP transport enforces authentication before processing MCP methods including initialize, tools/list, tools/call, resources/read, and prompts/get. Default deployments should prefer binding the service to loopback unless broader exposure is explicitly required.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

MervinPraisonPraisonaiapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

No public activity tracked yet. Mallory keeps watching.

0 SOURCESView more in app

No public activity observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity