Is CVE-2026-56076 exploitable?

No community verdicts yet for CVE-2026-56076. Be the first to weigh in.

Is CVE-2026-56076 a false positive?

No community verdicts yet for CVE-2026-56076.

How do I remediate CVE-2026-56076?

See the authoritative references (NVD, vendor advisory) and community field notes on this page for remediation guidance.

CVE-2026-56076

is CVE-2026-56076real, exploitable, or a false positive? Here's the community verdict.

☆ Watch

High · CVSS 8.1EPSS 0.5%CWE-942

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

PraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI endpoint that allows remote attackers to trigger arbitrary agent execution. The POST /agui endpoint lacks authentication and hardcodes Access-Control-Allow-Origin: * headers, combined with Starlette's Content-Type-agnostic JSON parsing, enabling attackers to bypass CORS preflight checks via simple requests and exfiltrate sensitive agent responses including tool execution results and environment data.

References

NVD MITRE CVE.org

Published Jun 18, 2026

Embed this verdict

Markdown

[![TruePositive verdict](https://www.truepositive.app/cve/CVE-2026-56076/badge.svg)](https://www.truepositive.app/cve/CVE-2026-56076)

HTML

<a href="https://www.truepositive.app/cve/CVE-2026-56076"><img src="https://www.truepositive.app/cve/CVE-2026-56076/badge.svg" alt="TruePositive verdict for CVE-2026-56076"></a>

Live badge that updates automatically as the community verdict changes.

Community ground truth

In your experience, is this finding real and exploitable?

0 verdicts

Not a real issue

No account needed. Anonymous verdicts post as an unverified signal. Log in to make yours verified and earn reputation.

Field notes & remediation

Verdicts are the quick signal. Notes are the evidence and fixes behind them.

No notes yet. Be the first to share what you saw, or a fix that worked.

Add a field note or remediationoptional