CVE-2026-56077 | THREATINT

Description

PraisonAI before 1.5.115 contains an information disclosure vulnerability in the MultiAgentLedger component that allows attackers to access sensitive data by registering agents with duplicate IDs. Attackers can exploit the lack of agent ID uniqueness enforcement to share ledger instances and expose system prompts and conversation history between agents.

PUBLISHED Reserved 2026-06-18 | Published 2026-06-18 | Updated 2026-06-18 | Assigner VulnCheck

HIGH: 7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

MEDIUM: 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Problem types

Exposure of Resource to Wrong Sphere

Product status

Default status

unaffected

Any version before 1.5.115

affected

1.5.115 (semver)

unaffected

References

github.com/...isonAI/security/advisories/GHSA-766v-q9x3-g744 vendor-advisory

github.com/MervinPraison/PraisonAI product

www.vulncheck.com/...osure-via-shared-multiagentledger-state (VulnCheck Advisory: PraisonAI - Information Disclosure via Shared MultiAgentLedger State) third-party-advisory

cve.org (CVE-2026-56077)

nvd.nist.gov (CVE-2026-56077)

Download JSON