CVE-2026-55531: PraisonAI MCP HTTP Stream DOS Vulnerability

CVE-2026-55531 Overview

CVE-2026-55531 affects PraisonAI, a multi-agent teams system. The MCP HTTP Stream mcp_post handler creates a new _sessions entry for every initialize request. The handler does not call _cleanup_sessions or enforce a maximum session count. An unauthenticated remote caller can send repeated initialize requests to exhaust process memory. This resource exhaustion issue is classified under CWE-400. The flaw affects PraisonAI versions prior to 4.6.58, and version 4.6.58 introduces session cleanup and a PRAISONAI_MCP_MAX_SESSIONS limit.

Critical Impact
Unauthenticated attackers can trigger memory exhaustion in PraisonAI MCP servers, causing denial of service against multi-agent workloads.

Affected Products

PraisonAI versions prior to 4.6.58
MCP HTTP Stream mcp_post handler component
Deployments exposing the MCP endpoint without upstream rate limiting

Discovery Timeline

2026-08-25 - CVE-2026-55531 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-55531

Vulnerability Analysis

PraisonAI implements a Model Context Protocol (MCP) server that accepts HTTP Stream requests. The mcp_post handler creates a session record inside the _sessions dictionary each time a client sends an initialize request. Before version 4.6.58, the handler did not invoke _cleanup_sessions and did not cap the number of concurrent sessions. Repeated initialize calls grow the in-memory session map without bound. Because the endpoint accepts unauthenticated requests, any network-adjacent caller can drive the process into memory exhaustion and cause a denial of service against agent workloads.

Root Cause

The root cause is missing resource management in the MCP session lifecycle. Session objects are allocated on demand but never reclaimed until the process restarts. Absent a maximum-session guard, the handler treats every initialize call as valid state to persist.

Attack Vector

An unauthenticated remote attacker sends a stream of initialize requests to the MCP HTTP Stream endpoint. Each request appends to _sessions, consuming heap memory until the host runs out of resources. The attack requires no credentials and no user interaction beyond issuing HTTP requests to the exposed endpoint.

The upstream patch introduces defense-in-depth changes across PraisonAI, including bearer token authorization on the server layer and stricter input validation.

python

# Patch excerpt: authorization check added to server request handling
def _authorise_request(self, request) -> bool:
    """Verify bearer token when auth_token is configured."""
    token = self.config.auth_token
    if not token:
        return True
    auth = request.headers.get("Authorization", "")
    if auth.startswith("Bearer ") and auth[7:] == token:
        return True
    return request.headers.get("X-Auth-Token") == token

Source: PraisonAI security commit 2f9677a

Detection Methods for CVE-2026-55531

Indicators of Compromise

High-rate POST requests to the MCP HTTP Stream endpoint from a single or small set of source addresses
Sustained growth of PraisonAI process resident memory without corresponding legitimate workload
Repeated initialize method payloads in MCP request bodies without follow-on session traffic

Detection Strategies

Monitor PraisonAI processes for abnormal memory growth and correlate with MCP request volume
Enable web server access logs on the MCP endpoint and alert on unusual initialize request rates
Baseline normal MCP session counts and alert when active sessions exceed operational norms

Monitoring Recommendations

Track the _sessions dictionary size via application metrics or a health endpoint
Alert on out-of-memory events or unexpected restarts of PraisonAI worker processes
Log source IP, user-agent, and request cadence for every MCP HTTP Stream call to support forensic review

How to Mitigate CVE-2026-55531

Immediate Actions Required

Upgrade PraisonAI to version 4.6.58 or later
Configure the PRAISONAI_MCP_MAX_SESSIONS environment variable to a value appropriate for the deployment
Restrict network exposure of the MCP HTTP Stream endpoint to trusted callers only
Configure the auth_token option so the server rejects unauthenticated requests

Patch Information

The fix is delivered in PraisonAI v4.6.58. The patch invokes _cleanup_sessions inside mcp_post and enforces the PRAISONAI_MCP_MAX_SESSIONS cap. Additional hardening in commit 2f9677a adds bearer token authorization and input validation. Full details are published in the GitHub Security Advisory GHSA-wv94-5qcp-6m36.

Workarounds

Place PraisonAI behind a reverse proxy that enforces rate limiting and connection quotas on the MCP endpoint
Require authentication at the proxy layer until the upgrade is deployed
Run the PraisonAI process under a memory cgroup limit so exhaustion attempts fail fast and restart cleanly

bash

# Example: set the session cap and restart the service after upgrading
export PRAISONAI_MCP_MAX_SESSIONS=100
pip install --upgrade "praisonai>=4.6.58"
systemctl restart praisonai