CVE-2026-56077

PraisonAI - Information Disclosure via Shared MultiAgentLedger State

State: Published
Severity: 7.1 High
Published: Jun 18, 2026
Updated: Jun 23, 2026
Reserved: Jun 18, 2026

Description

PraisonAI before 1.5.115 contains an information disclosure vulnerability in the MultiAgentLedger component that allows attackers to access sensitive data by registering agents with duplicate IDs. Attackers can exploit the lack of agent ID uniqueness enforcement to share ledger instances and expose system prompts and conversation history between agents.

Scores

CVSS	Score	Vector	Source
4.0	7.1 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	VulnCheck

Weaknesses

CWE-668 Exposure of Resource to Wrong Sphere

Affected Products

Product	Versions
PraisonAIPraisonAI	before 1.5.115Affected 1.5.115Not affected

References

https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-766v-q9x3-g744vendor-advisory
https://github.com/MervinPraison/PraisonAIproduct
VulnCheck Advisory: PraisonAI - Information Disclosure via Shared MultiAgentLedger Statethird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.