CVE-2026-56837 in PraisonAI
Summary
by MITRE • 10/23/2026
PraisonAI is a multi-agent teams system. From version 4.6.56 to before version 4.6.59, PraisonAI's LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEAR_WEBHOOK_SECRET as optional. When the secret is absent, startup only logs a warning and _handle_webhook() skips Linear-Signature verification entirely. An unauthenticated network caller who can reach the webhook endpoint can submit a forged Linear-Event: AgentSession request. The forged request is parsed, scheduled for background processing, dispatched to _handle_agent_session(), and passed into BotSessionManager.chat(). The bot then attempts to post the agent response back to Linear under the configured bot token. The PoV is offline and deterministic. It does not contact Linear. It calls the webhook handler directly, monkey-patches the outbound Linear comment path, and proves both sides of the boundary. This issue has been patched in version 4.6.59.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in PraisonAI versions ranging from 4.6.56 to just before 4.6.59 represents a critical authentication bypass within its multi-agent team orchestration system, specifically affecting the LinearBot component. This flaw stems from an insecure default configuration and insufficient input validation mechanisms during the initialization of public webhook listeners. The core technical deficiency lies in how the application handles the LINEAR_WEBHOOK_SECRET environment variable. In vulnerable versions, this secret is treated as optional rather than mandatory for security-critical operations. When the secret is absent or not properly configured, the startup sequence merely logs a warning message but proceeds to initialize the webhook listener on all network interfaces (0.0.0.0). This exposure makes the service accessible from any reachable network segment, significantly expanding the attack surface beyond intended boundaries.
The operational impact of this misconfiguration allows unauthenticated actors with network access to the host machine or exposed port to interact directly with the internal agent processing pipeline. Specifically, an attacker can submit a forged Linear-Event: AgentSession request without providing valid cryptographic signatures. The _handle_webhook() function fails to perform Linear-Signature verification when the secret is missing, effectively disabling the integrity check that ensures requests originate from legitimate sources. Consequently, maliciously crafted payloads are parsed and scheduled for background processing by the system's task scheduler. These forged events are then dispatched to the _handle_agent_session() method and passed into BotSessionManager.chat(), allowing external inputs to influence internal agent behavior without authorization.
This vulnerability aligns with CWE-287 Improper Authentication, as the application fails to correctly verify credentials or identity before granting access to sensitive functions. Furthermore, it relates to CWE-16 Configuration Error due to the insecure default handling of security secrets and binding to all interfaces. From an ATT&CK perspective, this flaw facilitates Initial Access via valid accounts if combined with other vectors, but primarily represents a mechanism for unauthorized command execution or data manipulation through API abuse (T1059). The ability to inject arbitrary agent sessions enables potential lateral movement within the AI orchestration layer and could lead to unintended actions being performed by connected bots.
The proof of concept demonstrates that the issue is deterministic and does not require external network calls to Linear, indicating a self-contained exploitation path. By calling the webhook handler directly and monkey-patching the outbound Linear comment path, attackers can prove both sides of the boundary: receiving forged input and observing how it propagates through the system. This confirms that internal state manipulation is possible without triggering standard security controls. The severity is heightened by the fact that the bot attempts to post responses back to Linear using configured tokens, meaning successful exploitation could result in unauthorized actions being executed on behalf of the service account within the integrated platform.
Mitigation requires immediate upgrading to version 4.6.59 or later where this logic has been corrected. Administrators must ensure that LINEAR_WEBHOOK_SECRET is strictly enforced as a mandatory configuration parameter and that webhook listeners are bound only to localhost (127.0.0.1) unless external access is explicitly required and secured via additional network-level controls such as firewalls or reverse proxies with IP whitelisting. Regular audits of environment variable configurations should be conducted to prevent similar misconfigurations in other components, ensuring that security-critical secrets are never treated as optional during runtime initialization.