CVE-2026-56077: PraisonAI MultiAgentLedger Information Disclosure via Duplicate Agent IDs

Technical summary

The vulnerability exists in PraisonAI's MultiAgentLedger component, which lacks input validation to prevent duplicate agent ID registration. When agents are created with identical IDs, they reference the same underlying ledger instance rather than maintaining separate data stores. This shared state violates the isolation principle and exposes sensitive artifacts including system prompts (which often contain instructions, rules, and behavioral constraints) and complete conversation histories. The flaw requires authenticated access (PR:L in the CVSS vector) but no user interaction, making it exploitable by any user with legitimate PraisonAI credentials.

Business impact

Organizations deploying PraisonAI for multi-agent workflows risk exposure of proprietary agent instructions, internal reasoning patterns, and conversation data across their deployment. This is particularly concerning if PraisonAI is used in sensitive domains (customer support, internal decision-making, or knowledge work) where conversation history or system prompts contain business logic, customer information, or confidential instructions. The breach of agent isolation could also enable lateral movement or privilege escalation if agents operate with different permission levels. Competitors or malicious insiders could reverse-engineer agent behavior and decision logic.

Affected systems

All PraisonAI installations prior to version 1.5.115 are vulnerable. The vulnerability does not appear to affect specific operating systems or architectures, as it is an application-level logic flaw. Any deployment using the affected MultiAgentLedger component is in scope. Verify your installed version against the PraisonAI release history to determine exposure.

Exploitability

Exploitation requires valid authentication credentials to the PraisonAI instance, limiting the attack surface to internal users or attackers with compromised credentials. No network connectivity constraints apply (AV:N), and the attack is straightforward—simply register an agent using a duplicate ID of an existing agent. The CVSS score of 6.5 (MEDIUM) reflects the requirement for prior authentication. The attack is not novel or particularly sophisticated, meaning any insider with basic familiarity with agent registration could execute it. No specialized tools or public exploits are necessary.

Remediation

Upgrade to PraisonAI version 1.5.115 or later. The patched version enforces unique agent ID constraints at the registration layer, preventing duplicate IDs from being created or assigned to existing agents. Organizations should verify the upgrade path and any breaking changes by consulting the official PraisonAI release notes. If an immediate upgrade is not feasible, implement network-level access controls to limit who can register agents, and monitor agent registration logs for duplicate ID attempts.

Patch guidance

Apply the upgrade to PraisonAI 1.5.115 as part of your normal patch cycle. Before deploying to production, test the upgrade in a staging environment to confirm compatibility with your agent configurations and any custom extensions. Review the changelog for that version to identify any configuration changes or deprecations. After upgrade, verify that existing agents continue to function and that agent isolation is properly enforced by confirming that agents can no longer access each other's ledger data.

Detection guidance

Monitor PraisonAI agent registration logs for attempts to create agents with duplicate IDs. Legitimate workflows should create agents with unique identifiers; duplicate attempts are a strong signal of exploitation. Additionally, audit ledger access patterns—if a single agent's credentials are accessing ledger data for multiple distinct agents simultaneously, this indicates a cross-agent data leakage event. Enable verbose logging on the MultiAgentLedger component if available. Query historical logs to identify whether an attacker may have already exploited this vulnerability before you patch.

Why prioritize this

While the CVSS score is MEDIUM, the information disclosure severity and the requirement for only low-privileged authentication make this a business-critical fix. Insider threats and compromised accounts pose a real risk in most organizations. The exposure of system prompts and conversation histories can compromise intellectual property and customer trust. Although not yet in the CISA KEV catalog, the simplicity of exploitation and the high business impact justify treating this as a priority patch, particularly for organizations whose PraisonAI deployment handles sensitive or customer-facing data.

Risk score, explained

The CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N yields a score of 6.5 (MEDIUM). The high confidentiality impact (C:H) reflects unrestricted access to sensitive data once the attacker gains the foothold. The low attack complexity (AC:L) and lack of user interaction required (UI:N) increase the score. However, the requirement for valid credentials (PR:L) and the lack of impact on integrity or availability prevent a higher severity rating. In practice, the business risk may feel higher than 6.5 suggests due to the nature of the exposed data (proprietary logic and customer information) and the ease of exploitation.

Frequently asked questions