PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)

Summary

The PraisonAI MCP HTTP-stream server creates a new in-memory session on every initialize request and never removes it. The cleanup routine that would expire sessions (_cleanup_sessions) is defined but never called anywhere in the codebase, and the configured session TTL is never enforced. There is no cap on the number of sessions. Because initialize requires no authentication and the server keeps every session dictionary forever, an attacker who can reach the endpoint (directly when the server is bound to a routable address, or from a victim's browser via the separate Origin-validation bypass) can drive memory usage up without bound until the process is killed by the out-of-memory killer. The same unbounded-growth pattern also applies to the cancelled-requests set populated by notifications/cancelled.

Details

In transports/http_stream.py, each initialize creates and stores a session with no limit:

if body.get("method") == "initialize":
    new_session_id = str(uuid.uuid4())
    self._sessions[new_session_id] = {
        "created_at": time.time(),
        "last_activity": time.time(),
    }

A cleanup method exists:

def _cleanup_sessions(self) -> None:
    now = time.time()
    expired = [sid for sid, data in self._sessions.items()
               if now - data["last_activity"] > self.session_ttl]
    for sid in expired:
        del self._sessions[sid]

but grep across the package shows it has no call sites: it is never invoked on a timer, on request handling, or from any background task. self.session_ttl (default 3600) is stored and otherwise unused. There is no maximum-session check anywhere on the write path. As a result self._sessions grows monotonically for the lifetime of the process.

initialize is unauthenticated: in mcp_post the API-key check is skipped when no key is configured (the default), and initialize does not require a prior session. The Origin check is the only gate, and a request with no Origin header is allowed; additionally the Origin allowlist is bypassable (see the companion report on the startswith Origin-validation bypass), so the endpoint is reachable from a malicious web page as well as directly.

The server-side cancellation set in server.py has the same defect:

if method == "notifications/cancelled":
    request_id = params.get("requestId")
    if request_id:
        self._cancelled_requests.add(str(request_id))   # never cleared

self._cancelled_requests is an unbounded set that is added to but never pruned.

PoC

scripts/poc_mcp_session_dos.sh. Start the server (default config, no API key):

praisonai mcp serve --transport http-stream --host 127.0.0.1 --port 8080