PraisonAI MultiAgentLedger Information Disclosure via Duplicate Agent IDs

Publication date: 2026-06-18

Last updated on: 2026-06-23

Assigner: VulnCheck

Description

PraisonAI before 1.5.115 contains an information disclosure vulnerability in the MultiAgentLedger component that allows attackers to access sensitive data by registering agents with duplicate IDs. Attackers can exploit the lack of agent ID uniqueness enforcement to share ledger instances and expose system prompts and conversation history between agents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-18

Last Modified

2026-06-23

Generated

2026-07-09

AI Q&A

2026-06-19

EPSS Evaluated

2026-07-08

NVD

CVE-2026-56077

EUVD

EUVD-2026-37961

Affected Vendors & Products

Vendor	Product	Version / Range
praisonai	multiagentledger	to 1.5.115 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-668	The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

Attack-Flow Graph

Executive Summary

This vulnerability exists in PraisonAI versions before 1.5.115 within the MultiAgentLedger component. It allows attackers to access sensitive information by registering agents with duplicate IDs. Because the system does not enforce uniqueness of agent IDs, attackers can share ledger instances and thereby expose system prompts and conversation histories between agents.

Impact Analysis

The impact of this vulnerability is information disclosure. Attackers with low privileges can exploit the lack of agent ID uniqueness to access sensitive data such as system prompts and conversation histories between agents. This could lead to exposure of confidential or private information within the affected system.

Hi! I’m here to help you understand CVE-2026-56077. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70