PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream _validate_origin uses request_origin.startswith(allowed), allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests without preflight and invoke tools/call without an API key, including file writes that persist agent instructions. This issue is fixed in version 4.6.58.

CVE-2026-55532 affects PraisonAI, a multi-agent teams system, in versions prior to 4.6.58. The vulnerability exists in the MCP HTTP Stream _validate_origin function, which uses a startswith() check to validate request origins against an allowlist. An attacker can craft a malicious origin such as localhost.attacker.com that satisfies the localhost allowlist check due to the flawed string prefix matching. This allows cross-origin requests to be sent without CORS preflight by using Content-Type: text/plain, enabling unauthenticated access to the tools/call API endpoint without an API key. Successful exploitation can lead to unauthorized file writes that persist malicious agent instructions, potentially compromising the integrity of AI agent behavior. The vulnerability has been patched in PraisonAI version 4.6.58.