CVE-2026-56077

Medium

Description

PraisonAI before 1.5.115 contains an information disclosure vulnerability in the MultiAgentLedger component that allows attackers to access sensitive data by registering agents with duplicate IDs. Attackers can exploit the lack of agent ID uniqueness enforcement to share ledger instances and expose system prompts and conversation history between agents.

SeverityMedium

CVSS6.5

Exploit probability—

ProductPraisonAI

PublishedJun 18, 2026

First seenJun 18, 2026

Weakness typeCWE-668CWE-668

How to fix

Update

PraisonAI PraisonAI1.5.115 or later

Vendor advisories

github.com/MervinPraison/PraisonAI/security/advisories/GHSA-766v-q9x3-g744

Affected products

Product	Affected versions	Fixed in
PraisonAI PraisonAI	v < 1.5.115	1.5.115

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.