Session Management Flaw in PraisonAI Affects Memory Resources

CVE-2026-55531

What is CVE-2026-55531?

PraisonAI, a multi-agent team system, has a vulnerability in its MCP HTTP Stream mcp_post handler where it fails to manage sessions effectively. Specifically, prior to version 4.6.58, each initialization request generates a new session entry without invoking cleanup or enforcing a limit on the number of concurrent sessions. This flaw enables an unauthenticated attacker to potentially exhaust system memory resources, resulting in degraded performance or service disruption. The issue has been mitigated in version 4.6.58 by invoking session cleanup and setting a maximum limit on active sessions through the defined constant PRAISONAI_MCP_MAX_SESSIONS.

References