CVE-2026-55531— PraisonAI: Unauthenticated unbounded session accumulation in the PraisonAI MCP HTTP server (memory exhaustion; session TTL never enforced)
Quick assessment
Affected
MervinPraison PraisonAI
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PraisonAI 是一个多智能体协作系统。在 praisonai 版本 4.6.58 之前，MCP HTTP Stream 的 处理器为每个初始化请求都会创建一个新的 条目，但未调用 方法来清理会话，也未对会话数量设置上限。攻击者无需认证即可通过大量初始化请求耗尽系统内存。该问题已在版本 4.6.58 中得到修复，修复方式是通过启用清理机制并借助配置项 限制最大会话数。
Possible ATT&CK Techniques 1 AI
T1496 · Resource HijackingAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MervinPraison | PraisonAI | < 4.6.58 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-55531
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PraisonAI: Unauthenticated unbounded session accumulation in the PraisonAI MCP HTTP server (memory exhaustion; session TTL never enforced)
Source: CVE Program / CVE List V5
Vulnerability Description
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream mcp_post handler creates a new _sessions entry for every initialize request but does not call _cleanup_sessions or enforce a maximum. An unauthenticated caller can exhaust memory. The fix invokes cleanup and limits sessions through PRAISONAI_MCP_MAX_SESSIONS. This issue is fixed in version 4.6.58.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MervinPraison | PraisonAI | < 4.6.58 | - |
|
II. Public POCs for CVE-2026-55531
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55531
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-55531 (1)
-
🔗 Release PraisonAI v4.6.58 · MervinPraison/PraisonAI · GitHub x_refsource_MISC
Vendor Advisories for CVE-2026-55531 (1)
Same Patch Batch · MervinPraison · 2026-08-25 · 17 CVEs total
| CVE-2026-55536 | 9.1 CRITICAL | Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CV |
| CVE-2026-55541 | 8.8 HIGH | PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced |
| CVE-2026-55534 | 8.6 HIGH | PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent executi |
| CVE-2026-55539 | 8.6 HIGH | PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — |
| CVE-2026-55526 | 8.5 HIGH | PraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved ho |
| CVE-2026-55528 | 8.2 HIGH | praisonaiagents: AgentServer declares auth_token but never enforces it on any route (CWE-8 |
| CVE-2026-55533 | 8.2 HIGH | PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when AP |
| CVE-2026-55532 | 7.6 HIGH | PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cros |
| CVE-2026-55525 | 7.5 HIGH | PraisonAI: SSRF via redirect-following in praisonaiagents web_crawl |
| CVE-2026-55538 | 7.3 HIGH | PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-in |
| CVE-2026-55537 | 7.1 HIGH | PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — b |
| CVE-2026-55527 | 7.1 HIGH | PraisonAI: Arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — pat |
| CVE-2026-55540 | 7.1 HIGH | PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks |
| CVE-2026-55529 | 6.9 MEDIUM | PraisonAI: Origin validation bypass in MCP HTTP Stream transport allows browser-mediated u |
| CVE-2026-55535 | 6.8 MEDIUM | PraisonAI: Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation |
| CVE-2026-55530 | 6.1 MEDIUM | PraisonAI: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate en |
IV. Related Vulnerabilities
Same product: PraisonAI
-
CVE-2026-55536
Browser Server WebSocket origin validation bypass via unanch -
CVE-2026-55532
PraisonAI: Origin-validation bypass (startswith prefix match -
CVE-2026-55533
PraisonAI: Authentication fail-open in Recipe server allows -
CVE-2026-55539
PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/ -
CVE-2026-55527
PraisonAI: Arbitrary file write via unsanitized `user_id` in
Same vendor: MervinPraison
-
CVE-2026-55536
Browser Server WebSocket origin validation bypass via unanch -
CVE-2026-55532
PraisonAI: Origin-validation bypass (startswith prefix match -
CVE-2026-55533
PraisonAI: Authentication fail-open in Recipe server allows -
CVE-2026-55539
PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/ -
CVE-2026-55527
PraisonAI: Arbitrary file write via unsanitized `user_id` in
Same weakness: CWE-400
-
CVE-2026-68763
Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tra -
CVE-2026-77357
Mesop: DoS in /hot-reload endpoint allows unauthenticated at -
CVE-2026-53965
MCP PHP SDK: Unbounded SSE buffer in HttpTransport enables c -
CVE-2026-55588
ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursio -
CVE-2026-55099
icalendar: Algorithmic Complexity in Equality
V. Comments for CVE-2026-55531
No comments yet