Webhook Security Flaw in PraisonAI Affects Multiple Versions
CVE-2026-56837

8.6HIGH

Key Information:

Vendor

Mervinpraison

Status
Praisonai
Vendor
CVE Published:
23 October 2026

What is CVE-2026-56837?

PraisonAI, a multi-agent teams system, has introduced a serious vulnerability that allows unauthenticated access through its webhook listener. From versions 4.6.56 to just prior to 4.6.59, the LinearBot component starts its webhook listener on the public IP address 0.0.0.0, mistakenly treating the LINEAR_WEBHOOK_SECRET as optional. This oversight means that if the secret is not provided, the startup process only logs a warning, and crucial Linear-Signature verification is entirely bypassed. Consequently, an attacker with network access can submit forged Linear-Event: AgentSession requests, which are processed and dispatched without the necessary authentication checks, allowing for unauthorized interactions with the bot's operations. This vulnerability has been addressed in version 4.6.59, highlighting the importance of keeping software up to date to mitigate such security risks.

Affected Version(s)

PraisonAI >= 4.6.56, < 4.6.59

References

https://github.com/MervinPraison/PraisonAI/security/advis...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.