CVE-2026-55531: PraisonAI unauth memory exhaustion

CISO Take

PraisonAI's MCP HTTP Stream handler creates a new session object for every initialize request but never cleans up or caps them, letting an unauthenticated attacker who can reach the endpoint exhaust server memory with repeated requests. There's no EPSS score yet, no public exploit or Nuclei template, and it's not in CISA KEV, so this reads as low-urgency opportunistic risk rather than an imminent threat — but the attack itself requires nothing more than crafting repeated HTTP requests, so the barrier to exploitation is trivial once an endpoint is exposed. The blast radius is currently narrow (1 tracked downstream dependent), but PraisonAI ships as an agent orchestration framework, so any team running an exposed MCP server inherits this. Upgrade to praisonai 4.6.58 or later, which invokes session cleanup and enforces a hard cap via the new PRAISONAI_MCP_MAX_SESSIONS setting. Until patched, restrict network exposure of the MCP HTTP endpoint (put it behind auth or a private network) and monitor for anomalous memory growth or session counts correlated with unauthenticated initialize traffic.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Medium severity (CVSS 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) — network-reachable, low complexity, no privileges required, availability-only impact. The UI:R (user interaction required) qualifier is somewhat unusual for a server-side resource exhaustion bug and may reflect how the advisory scores the initialize handshake; in practice this is closer to a standard unauthenticated DoS against any exposed MCP HTTP Stream endpoint. No EPSS data, no KEV listing, no public PoC/exploit, no Nuclei template — exploitation is plausible but not currently observed in the wild. Real-world exposure hinges on whether operators expose the MCP HTTP endpoint to untrusted networks; if isolated behind auth/VPN, practical risk drops significantly.

How does the attack unfold?

Initial Access

Attacker identifies a network-reachable PraisonAI MCP HTTP Stream endpoint requiring no authentication.

AML.T0049

Exploitation

Attacker sends repeated 'initialize' requests to the mcp_post handler, each creating a new unmanaged session entry.

AML.T0034

Impact

Server memory is exhausted as sessions accumulate without cleanup or cap, crashing or degrading the agent orchestration service.

AML.T0029

Initial Access

Attacker identifies a network-reachable PraisonAI MCP HTTP Stream endpoint requiring no authentication.

AML.T0049

Exploitation

Attacker sends repeated 'initialize' requests to the mcp_post handler, each creating a new unmanaged session entry.

AML.T0034

Impact

Server memory is exhausted as sessions accumulate without cleanup or cap, crashing or degrading the agent orchestration service.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	< 4.6.58	`4.6.58`
1 dependents61% patched~23d to patchFull package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 39% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

Upgrade to praisonai >= 4.6.58, which enforces session cleanup and caps concurrent sessions via PRAISONAI_MCP_MAX_SESSIONS. If immediate upgrade isn't possible: place the MCP HTTP Stream endpoint behind authentication, a reverse proxy with rate limiting, or restrict it to trusted internal networks only. Monitor process memory and open session counts on hosts running PraisonAI's MCP server; alert on abnormal growth correlated with repeated initialize requests. Set an explicit low PRAISONAI_MCP_MAX_SESSIONS value post-upgrade rather than relying on defaults.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSAgentAML.T0034- Cost Harvesting AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.4-AI system operation and monitoring

NIST AI RMF

MEASURE 2.7-AI system security and resilience

OWASP LLM Top 10

LLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-55531?

PraisonAI's MCP HTTP Stream handler creates a new session object for every initialize request but never cleans up or caps them, letting an unauthenticated attacker who can reach the endpoint exhaust server memory with repeated requests. There's no EPSS score yet, no public exploit or Nuclei template, and it's not in CISA KEV, so this reads as low-urgency opportunistic risk rather than an imminent threat — but the attack itself requires nothing more than crafting repeated HTTP requests, so the barrier to exploitation is trivial once an endpoint is exposed. The blast radius is currently narrow (1 tracked downstream dependent), but PraisonAI ships as an agent orchestration framework, so any team running an exposed MCP server inherits this. Upgrade to praisonai 4.6.58 or later, which invokes session cleanup and enforces a hard cap via the new PRAISONAI_MCP_MAX_SESSIONS setting. Until patched, restrict network exposure of the MCP HTTP endpoint (put it behind auth or a private network) and monitor for anomalous memory growth or session counts correlated with unauthenticated initialize traffic.

Is CVE-2026-55531 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-55531, increasing the risk of exploitation.

How to fix CVE-2026-55531?

Upgrade to praisonai >= 4.6.58, which enforces session cleanup and caps concurrent sessions via PRAISONAI_MCP_MAX_SESSIONS. If immediate upgrade isn't possible: place the MCP HTTP Stream endpoint behind authentication, a reverse proxy with rate limiting, or restrict it to trusted internal networks only. Monitor process memory and open session counts on hosts running PraisonAI's MCP server; alert on abnormal growth correlated with repeated initialize requests. Set an explicit low PRAISONAI_MCP_MAX_SESSIONS value post-upgrade rather than relying on defaults.

What systems are affected by CVE-2026-55531?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, model serving.

What is the CVSS score for CVE-2026-55531?

CVE-2026-55531 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.45%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmodel serving

MITRE ATLAS Techniques

AML.T0034Cost Harvesting

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.4

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream mcp_post handler creates a new _sessions entry for every initialize request but does not call _cleanup_sessions or enforce a maximum. An unauthenticated caller can exhaust memory. The fix invokes cleanup and limits sessions through PRAISONAI_MCP_MAX_SESSIONS. This issue is fixed in version 4.6.58.

Exploitation Scenario

An attacker discovers a PraisonAI MCP HTTP Stream endpoint exposed on the internet or an internal network segment they've gained access to. Without any authentication, they script repeated 'initialize' requests to the mcp_post handler. Each request allocates a new session object server-side with no expiration or ceiling, so memory consumption climbs linearly with request volume. Once available memory is exhausted, the process crashes or becomes unresponsive, disrupting the agent orchestration service and any workflows depending on it — a simple, low-skill denial-of-service requiring only an HTTP client capable of sending repeated requests.

Weaknesses (CWE)

CWE-400Uncontrolled Resource ConsumptionPrimary CWE-400Uncontrolled Resource ConsumptionPrimary CWE-770Allocation of Resources Without Limits or ThrottlingPrimary CWE-770Allocation of Resources Without Limits or ThrottlingPrimary CWE-400Uncontrolled Resource Consumption CWE-770Allocation of Resources Without Limits or Throttling

CWE-400 — Uncontrolled Resource Consumption: The product does not properly control the allocation and maintenance of a limited resource.

[Architecture and Design] Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
[Architecture and Design] Mitigation of resource exhaustion attacks requires that the target system either: The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question. The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker. recognizes the attack and denies that user further access for a given amount of time, or uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.

Source: MITRE CWE corpus.