What happened
PraisonAI's TypeScript AgentOS and MCP HTTP server default to binding on all interfaces and expose agent-invocation and MCP tool-call endpoints with no authentication check, letting any network-reachable client invoke agents or MCP tools as if it were a trusted client.
Why it matters
This is the same 'unauthenticated-by-default, bound to 0.0.0.0' pattern responsible for a large share of the PraisonAI CVE batch this cycle; it hands any network-adjacent attacker (or internet-wide scanner, for cloud-deployed instances) direct, unauthenticated control over agent invocation and MCP tool calls — a full agent-hijack primitive with no exploit complexity.
Attack vector
AgentOS binds to 0.0.0.0 by default and registers GET /api/agents and POST /api/chat without any authentication middleware; a related flaw has MCPServer.startHttp() bind without host restriction and forward every HTTP POST to handleRequest() unauthenticated. Any network client that can reach the port can enumerate configured agents and invoke chat/agent actions, or make arbitrary MCP tool calls, with no credentials.
Affected systems
PraisonAI (praisonai-ts), AgentOS from 1.6.0 until 1.7.2; related MCPServer.startHttp() issue (CVE-2026-57139) from 1.5.0 until 1.7.2
Mitigation
Upgrade to praisonai-ts 1.7.2 or later, which adds required authentication middleware. Until patched, bind AgentOS/MCP HTTP listeners to loopback only and place them behind an authenticating reverse proxy — do not expose 0.0.0.0 to any untrusted network.