PraisonAI is a multi-agent teams system. Prior to version 4.6.40, the fix for GHSA-9mqq-jqxf-grvw / CVE-2026-44336 is incomplete. The original advisory description named four vulnerable handlers in "mcp_server/adapters/cli_tools.py". Commit "68cc9427" ("fix(security): harden MCP rules path handling…") added a "_resolve_rule_path()" helper and applied it to "rules.create", "rules.show", and "rules.delete". "workflow.show" was left unchanged. Two adjacent handlers in the same file have the same pattern, "workflow.validate" and "deploy.validate". Neither was mentioned in the original advisory. Both remained unchanged. The original advisory also identified the dispatcher ("server.py:281-298") as a root cause. It accepts unvalidated "**kwargs" from "params["arguments"]" with no enforcement against the tool's declared "input_schema". That code is unchanged prior to version 4.6.40. A single unauthenticated MCP "tools/call" to "praisonai.workflow.show" returns the contents of any file the host user can read: "/etc/passwd", "~/.ssh/id_rsa", "~/.aws/credentials", or any project ".env". Version 4.6.40 contains an updated fix.