Description
PraisonAI is a multi-agent teams system. From version 4.6.56 to before version 4.6.59, PraisonAI's LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEAR_WEBHOOK_SECRET as optional. When the secret is absent, startup only logs a warning and _handle_webhook() skips Linear-Signature verification entirely. An unauthenticated network caller who can reach the webhook endpoint can submit a forged Linear-Event: AgentSession request. The forged request is parsed, scheduled for background processing, dispatched to _handle_agent_session(), and passed into BotSessionManager.chat(). The bot then attempts to post the agent response back to Linear under the configured bot token. The PoV is offline and deterministic. It does not contact Linear. It calls the webhook handler directly, monkey-patches the outbound Linear comment path, and proves both sides of the boundary. This issue has been patched in version 4.6.59.
Published: 2026-10-23
Score: 8.6 High
EPSS: n/a
KEV: No
Impact: Unauthorized bot actions via forged webhooks that can result in unintended messages or actions in Linear
Action: Immediate patch
AI Analysis

Impact

PraisonAI’s LinearBot begins a public webhook listener when the environment variable LINEAR_WEBHOOK_SECRET is absent and skips signature verification completely. An unauthenticated network caller can send a forged Linear‑Event: AgentSession payload. The webhook handler accepts and schedules the request for background processing, dispatches it to the bot’s chat routine, and the bot then attempts to post a response back to Linear using its configured bot token. The vulnerability allows the attacker to control the content that the bot posts in Linear and to trigger arbitrary bot behavior without authenticating first.

Affected Systems

The flaw affects PraisonAI versions 4.6.56 through 4.6.58 inclusive. The system is a multi‑agent team platform with a publicly accessible webhook listener on 0.0.0.0 until the patch in version 4.6.59 is applied.

Risk and Exploitability

The CVSS score of 8.6 marks the issue as high severity. EPSS is not available, and the vulnerability is not listed in CISA KEV. An attacker only needs external network reach to the 0.0.0.0 webhook endpoint; no credentials or privileged access are required. The PoV is offline and deterministic, meaning an attacker can repeat the attack reliably without interacting with the live Linear service.

Generated by OpenCVE AI on October 23, 2026 at 13:40 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade PraisonAI to 4.6.59 or later to apply the official patch.
  • Configure a non‑empty LINEAR_WEBHOOK_SECRET so that signed requests are required and unsigned requests are rejected.
  • Restrict access to the webhook listener by firewall rules or by binding the service to localhost to prevent unauthenticated callers from reaching the endpoint.
  • Disable or remove any unused webhook endpoints until a secure secret is in place.
  • Continuously monitor webhook logs for unexpected AgentSession requests and review any outbound comments posted to Linear by the bot.

Generated by OpenCVE AI on October 23, 2026 at 13:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-fc26-m9pf-v56q PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing
History

Fri, 23 Oct 2026 12:00:00 +0000

Type Values Removed Values Added
Description PraisonAI is a multi-agent teams system. From version 4.6.56 to before version 4.6.59, PraisonAI's LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEAR_WEBHOOK_SECRET as optional. When the secret is absent, startup only logs a warning and _handle_webhook() skips Linear-Signature verification entirely. An unauthenticated network caller who can reach the webhook endpoint can submit a forged Linear-Event: AgentSession request. The forged request is parsed, scheduled for background processing, dispatched to _handle_agent_session(), and passed into BotSessionManager.chat(). The bot then attempts to post the agent response back to Linear under the configured bot token. The PoV is offline and deterministic. It does not contact Linear. It calls the webhook handler directly, monkey-patches the outbound Linear comment path, and proves both sides of the boundary. This issue has been patched in version 4.6.59.
Title PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing
Weaknesses CWE-287
CWE-306
CWE-347
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-23T11:57:48.068Z

Reserved: 2026-06-23T14:55:09.117Z

Link: CVE-2026-56837

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-23T12:18:15.203

Modified: 2026-10-23T12:18:15.320

Link: CVE-2026-56837

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T13:45:17Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function

  • CWE-347

    Improper Verification of Cryptographic Signature