EUVD-2026-37961
GHSA-qwwv-hc99-6f5p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable agent API with low-privileged authenticated caller registering an ID; confidentiality-only impact on victim ledger context, no integrity or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
PraisonAI before 1.5.115 contains an information disclosure vulnerability in the MultiAgentLedger component that allows attackers to access sensitive data by registering agents with duplicate IDs. Attackers can exploit the lack of agent ID uniqueness enforcement to share ledger instances and expose system prompts and conversation history between agents.
AnalysisAI
Information disclosure in PraisonAI before 1.5.115 allows authenticated agents to read other agents' system prompts and conversation history by exploiting missing uniqueness enforcement on agent identifiers in the MultiAgentLedger component. An attacker who can register an agent with a colliding ID receives the same ledger instance as the victim, breaking tenant isolation in multi-agent deployments. No public exploit identified at time of analysis, though the upstream GHSA advisory (GHSA-766v-q9x3-g744) publishes a working proof-of-concept demonstrating the collision.
Technical ContextAI
PraisonAI is a Python multi-agent orchestration framework (pip package praisonaiagents) used to build LLM-driven agent workflows. The MultiAgentLedger class maintains a Python dictionary self.ledgers keyed by agent ID, and its get_agent_ledger method only instantiates a new ledger when the key is absent - otherwise it returns the existing one. Because no uniqueness check, namespace, or ownership binding is enforced on agent IDs, two distinct callers registering the same ID share a single ledger object holding system prompts and conversation history. This maps to CWE-668 (Exposure of Resource to Wrong Sphere): a logical resource intended to be per-agent is exposed across agent boundaries. The same advisory also flags an adjacent CWE-22 path traversal in MultiAgentMonitor where agent IDs are concatenated into file paths without sanitization, though that is a separate weakness from CVE-2026-56077's information disclosure scope.
RemediationAI
Vendor-released patch: 1.5.115 - upgrade praisonaiagents to 1.5.115 or later via pip install --upgrade praisonaiagents, per the GHSA-766v-q9x3-g744 advisory. If immediate upgrade is not possible, compensating controls are to (a) restrict agent registration to a trusted control plane and reject client-supplied agent IDs in favor of server-generated UUIDs, which eliminates the collision primitive but requires updating any client code that assumes caller-chosen IDs, and (b) namespace agent IDs by tenant or user (e.g., prefix with an authenticated principal hash) before they reach MultiAgentLedger, which preserves caller naming at the cost of a small wrapper layer. Operators should also review any MultiAgentMonitor base paths for the companion path-traversal issue documented in the same advisory and confirm no sensitive logs were cross-tenant accessible during the exposure window.
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an att
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can inf
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to ex
Remote unauthenticated access to PraisonAI's legacy Flask API server allows attackers to execute configured agent workfl
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the appl
Same weakness CWE-668 – Exposure of Resource to Wrong Sphere
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today