Dashboard / CVE-2026-56077

CVE-2026-56077

HIGH
MEDIUM Priority: 0.03 BB Relevance: 64/100
Published: 2026-06-18 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
AT: None
VC: High
VI: None
VA: None

Description

PraisonAI before 1.5.115 contains an information disclosure vulnerability in the MultiAgentLedger component that allows attackers to access sensitive data by registering agents with duplicate IDs. Attackers can exploit the lack of agent ID uniqueness enforcement to share ledger instances and expose system prompts and conversation history between agents.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
PraisonAI PraisonAI 0 < 1.5.115

References & Advisories (3)

Bug Bounty Relevance

64 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

7.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.45%
Raw Score 0.004450
Percentile 39.2%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00445
2026-11-12
0.00445
2026-11-10
0.00445
2026-11-09
0.00445
2026-11-08
0.00445

Intelligence Sources

mitre ref →

External Links