CVE-2026-56077CWE-668

PraisonAI - Information Disclosure via Shared MultiAgentLedger State

High · published June 18, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
37.7
In the wild
Unconfirmed
What it is

PraisonAI before 1.5.115 contains an information disclosure vulnerability in the MultiAgentLedger component that allows attackers to access sensitive data by registering agents with duplicate IDs. Attackers can exploit the lack of agent ID uniqueness enforcement to share ledger instances and expose system prompts and conversation history between agents.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00445 · 37.7th percentile
Weakness
CWE-668 · Exposure of Resource to Wrong Sphere
Published
2026-06-18T22:12Z
EPSS history
Timeline
  • 18 JUN 22:12Z
    PraisonAI - Information Disclosure via Shared MultiAgentLedger State
    cvelistv5