Three CVEs against PraisonAI's MCP HTTP transport reach NVD ten weeks after the fix shipped

Three CVE records against PraisonAI, a multi-agent framework whose repository carries roughly 9,000 stars, were published on 2026-08-25. All three sit in the framework's MCP HTTP Stream transport, and all three were fixed in praisonai 4.6.58 on 2026-06-13, ten weeks before the records appeared.

Two records describe the same validation defect from different attack positions. The transport's _validate_origin method checked incoming Origin headers with request_origin.startswith(allowed), a prefix match, so an attacker-controlled origin such as localhost.attacker.com passes a check meant to allow localhost. CVE-2026-55532 (7.6 high) covers the direct unauthenticated cross-site request forgery against the MCP HTTP server; CVE-2026-55529 (6.9 medium) covers the browser-mediated variant. String matching where a parser belongs is a recurring failure shape in these records: the CKAN SSRF filter bypass recorded on 2026-08-21 fell to hostname-string comparison in an outbound filter, and this one falls to prefix comparison on an inbound Origin header.

The third record, CVE-2026-55531 (6.5 medium), is resource exhaustion: the mcp_post handler created a new _sessions entry for every initialize request without calling cleanup or enforcing a session cap, so an unauthenticated sender could accumulate sessions until memory ran out. That is the same unbounded-session class as Spring AI's CVE-2026-59279, recorded four days earlier against a different framework.

The records themselves carry no exploitation claims. PraisonAI users on versions before 4.6.58 get all three fixes in one upgrade.