Am I affected by PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory…? What should I do?
The PraisonAI MCP HTTP-stream server creates a new in-memory session on every initialize request and never removes it.
Affected: PraisonAI < 4.6.58. Fixed in: 4.6.58. What should you check, and what should you do about it?
Full incident page with sources: https://agentarmorhq.com/incidents/2026/08/cve-2026-55531-praisonai (opens external site)
1 answer
Am I affected? Affected: PraisonAI < 4.6.58. Fixed in: 4.6.58.
- Check your version: run
pip show PraisonAI. Versions < 4.6.58 of PraisonAI are affected.
What to do now
- Upgrade to the fixed version: run
pip install --upgrade "PraisonAI>=4.6.58"(first patched version 4.6.58). - Require authentication by default on the HTTP-stream transport so that anonymous clients cannot create sessions at all.
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
Sources
- GitHub Advisory Database: https://github.com/advisories/GHSA-wv94-5qcp-6m36 (opens external site)
Full incident page: https://agentarmorhq.com/incidents/2026/08/cve-2026-55531-praisonai (opens external site)
Did this work for you?- Check your version: run