Executive brief
PraisonAI is a framework used to build and manage autonomous AI agents. A security flaw in how the system tracks these agents allows an attacker to access sensitive information, such as private conversation histories and internal system instructions, by reusing existing agent identifiers. This could lead to data leaks between different users or projects in a shared environment.
Technical details
The MultiAgentLedger component in PraisonAI fails to enforce uniqueness for agent identifiers. Because it uses a dictionary to store ledger instances keyed by agent ID, registering a new agent with an existing ID allows the second agent to share the same ledger instance. An attacker with network access and low privileges can exploit this collision to retrieve sensitive context data, including system prompts and conversation history, from a victim agent. Additionally, the MultiAgentMonitor component was found to be vulnerable to path traversal due to unsanitized agent IDs being used in file path construction. These issues are addressed in version 1.5.115.
Affected products
- MervinPraison PraisonAI < 1.5.115
Timeline
- 2026-04-07: advisory: GitHub Security Advisory published
- 2026-06-18: disclosed: NVD publication date