CVE-2026-56077: PraisonAI - Information Disclosure via Shared MultiAgentLedger State
PraisonAI before 1.5.115 contains an information disclosure vulnerability in the MultiAgentLedger component that allows attackers to access sensitive data by registering agents with duplicate IDs. Attackers can exploit the lack of agent ID uniqueness enforcement to share ledger instances and expose system prompts and conversation history between agents.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PraisonAIto a version that resolves this vulnerability.Fixed in 1.5.115 - Configuration
Enforce uniqueness of agent IDs in the MultiAgentLedger (implement server-side checks to reject duplicate agent registrations) to prevent ledger instance sharing and information disclosure.
MultiAgentLedger agent_id_uniqueness_enforcement = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56077?
The severity of CVE-2026-56077 is classified as medium with a score of 6.5.
How do I fix CVE-2026-56077?
To fix CVE-2026-56077, update to PraisonAI version 1.5.115 or later to ensure proper enforcement of unique agent IDs.
What type of vulnerability is CVE-2026-56077?
CVE-2026-56077 is an information disclosure vulnerability affecting the MultiAgentLedger component of PraisonAI.
Who can be impacted by CVE-2026-56077?
Users of PraisonAI prior to version 1.5.115 are at risk of exposure to sensitive data due to CVE-2026-56077.
What is the attack vector for CVE-2026-56077?
The attack vector for CVE-2026-56077 involves attackers registering agents with duplicate IDs to access shared ledger instances.