CVE-2026-56837: PraisonAI: missing webhook auth lets forged Linear events drive agent

HIGH

Published October 23, 2026

CISO Take

PraisonAI's LinearBot (versions 4.6.56 to before 4.6.59) opens a public webhook listener on 0.0.0.0 and treats LINEAR_WEBHOOK_SECRET as optional. If the secret is unset, it only logs a warning and skips signature verification, so anyone who can reach the endpoint can send a forged AgentSession event and make the agent process attacker-controlled input. The bot then posts the agent's response to Linear using the organization's bot token. The flaw is rated high (CVSS 8.6) and needs no privileges or user interaction. There is no KEV listing, public exploit, Nuclei template or EPSS data yet, but the attack is trivial and the advisory describes a deterministic proof of concept. Blast radius is limited by only 1 tracked downstream dependent, though the package has 187 other CVEs, which points to weak security hygiene. Upgrade to 4.6.59 or later, set LINEAR_WEBHOOK_SECRET on every deployment, and restrict network exposure of the listener.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

High. The vulnerability is exploitable over the network with low complexity, no privileges and no user interaction (CVSS 8.6). Only deployments running LinearBot without LINEAR_WEBHOOK_SECRET are exposed, and only if the listener is reachable by an attacker. Integrity impact is the highest: forged events trigger agent execution and outbound posts under a trusted bot identity. Exploitation likelihood is moderate to high because the exploit is trivial, though no public exploit, KEV listing or EPSS score exists yet. Confidentiality and availability impacts are low and depend on what the agent can access and how much it costs to run.

How does the attack unfold?

Discovery

Attacker finds a PraisonAI LinearBot webhook listener reachable from the network, with no secret configured.

AML.T0006

Initial Access

Attacker sends a forged Linear-Event: AgentSession request, which is accepted because Linear-Signature verification is skipped.

AML.T0049

Execution

The forged payload is queued and passed to the agent via BotSessionManager.chat(), so attacker-controlled input drives the agent.

AML.T0093

Impact

The bot posts agent output to Linear under its trusted token, enabling spoofed content, misuse of agent tools and wasted LLM spend.

AML.T0048

Discovery

Attacker finds a PraisonAI LinearBot webhook listener reachable from the network, with no secret configured.

AML.T0006

Initial Access

Attacker sends a forged Linear-Event: AgentSession request, which is accepted because Linear-Signature verification is skipped.

AML.T0049

Execution

The forged payload is queued and passed to the agent via BotSessionManager.chat(), so attacker-controlled input drives the agent.

AML.T0093

Impact

The bot posts agent output to Linear under its trusted token, enabling spoofed content, misuse of agent tools and wasted LLM spend.

AML.T0048

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents61% patched~23d to patchFull package profile →
PraisonAI	pip	—	No patch
1 dependents61% patched~23d to patchFull package profile →

How severe is it?

CVSS 3.1

8.6 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 8% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CLow

IHigh

ALow

What should I do?

1 step

1) Upgrade PraisonAI to 4.6.59 or later. 2) Set a strong LINEAR_WEBHOOK_SECRET on every deployment and configure the same secret in the Linear webhook settings; treat the startup warning about a missing secret as a deployment failure. 3) Do not expose the listener on 0.0.0.0 to the internet; bind to localhost or place it behind a reverse proxy, firewall or allowlist for Linear's webhook source IPs. 4) Detect abuse by reviewing webhook access logs for AgentSession requests lacking a valid Linear-Signature header or coming from unexpected sources, and audit Linear for unexpected bot comments. 5) Rotate the Linear bot token if suspicious activity is found, and limit the agent's tool permissions to least privilege.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassPrompt InjectionAgentAPIPluginAML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation AML.T0093- Prompt Infiltration via Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to and recover from previously unknown risks

OWASP LLM Top 10

LLM01-Prompt InjectionLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-56837?

Is CVE-2026-56837 actively exploited?

No confirmed active exploitation of CVE-2026-56837 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-56837?

1) Upgrade PraisonAI to 4.6.59 or later. 2) Set a strong LINEAR_WEBHOOK_SECRET on every deployment and configure the same secret in the Linear webhook settings; treat the startup warning about a missing secret as a deployment failure. 3) Do not expose the listener on 0.0.0.0 to the internet; bind to localhost or place it behind a reverse proxy, firewall or allowlist for Linear's webhook source IPs. 4) Detect abuse by reviewing webhook access logs for AgentSession requests lacking a valid Linear-Signature header or coming from unexpected sources, and audit Linear for unexpected bot comments. 5) Rotate the Linear bot token if suspicious activity is found, and limit the agent's tool permissions to least privilege.

What systems are affected by CVE-2026-56837?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration, chatbot integrations, webhook-driven automation.

What is the CVSS score for CVE-2026-56837?

CVE-2026-56837 has a CVSS v3.1 base score of 8.6 (HIGH). The EPSS exploitation probability is 0.19%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent orchestrationchatbot integrationswebhook-driven automation

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

AML.T0093Prompt Infiltration via Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM01, LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. From version 4.6.56 to before version 4.6.59, PraisonAI's LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEAR_WEBHOOK_SECRET as optional. When the secret is absent, startup only logs a warning and _handle_webhook() skips Linear-Signature verification entirely. An unauthenticated network caller who can reach the webhook endpoint can submit a forged Linear-Event: AgentSession request. The forged request is parsed, scheduled for background processing, dispatched to _handle_agent_session(), and passed into BotSessionManager.chat(). The bot then attempts to post the agent response back to Linear under the configured bot token. The PoV is offline and deterministic. It does not contact Linear. It calls the webhook handler directly, monkey-patches the outbound Linear comment path, and proves both sides of the boundary. This issue has been patched in version 4.6.59.

Exploitation Scenario

An attacker scans for exposed PraisonAI LinearBot webhook endpoints, or finds one through reconnaissance of the target's infrastructure. Because no secret is configured, the attacker sends a crafted POST with a Linear-Event: AgentSession header and a malicious payload containing instructions for the agent. The bot schedules the request, passes the text to the agent and, if tools are enabled, may act on it. It then posts the response to a Linear issue using the legitimate bot token, so the output appears to come from the organization's trusted agent. The attacker can repeat this at scale to inject misleading guidance into engineering workflows or to drive up LLM costs.

Weaknesses (CWE)

CWE-287Improper AuthenticationPrimary CWE-306Missing Authentication for Critical FunctionPrimary CWE-347Improper Verification of Cryptographic SignaturePrimary CWE-287Improper Authentication CWE-306Missing Authentication for Critical Function CWE-347Improper Verification of Cryptographic Signature

CWE-287 — Improper Authentication: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.