CVE-2026-57122: PraisonAI missing HMAC check lets

CISO Take

PraisonAI's WhatsApp and Linear webhook handlers only verify the HMAC signature when WHATSAPP_APP_SECRET or LINEAR_WEBHOOK_SECRET is set in the environment; if either secret is absent, the handler still parses and dispatches the incoming request body as trusted input. A remote, unauthenticated attacker who can reach the webhook route can therefore forge chat messages, Linear comments, or agent-session events, impersonate real platform users, and feed attacker-controlled content directly into the agent's decision loop, with a CVSS 3.1 score of 8.6 (network, no auth, no user interaction, high integrity impact). There is no evidence of active exploitation — it is not in CISA KEV, EPSS data is unavailable, and no public exploit or scanner template exists — so this looks like an unweaponized configuration-dependent flaw rather than an imminent mass-exploitation risk, but any deployment that omitted the secret env vars (a plausible default in quick setups) is exposed today. Patch to PraisonAI 4.6.59 or later immediately; as an interim workaround, ensure WHATSAPP_APP_SECRET and LINEAR_WEBHOOK_SECRET are always set (never leave them unconfigured) or block unauthenticated traffic to the webhook route at the network/reverse-proxy layer. Detection: audit webhook logs for requests missing a valid signature header and alert on any bot actions triggered by unsigned payloads.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

High severity (CVSS 8.6) but currently a latent, configuration-contingent flaw: the vulnerability only manifests when an operator has not set the relevant webhook secret, which is a plausible but not universal misconfiguration. Exploitability is trivial once the condition holds — no authentication, no user interaction, low attack complexity, purely network-reachable — so any exposed instance is immediately at risk. No KEV listing, no EPSS score, and no public exploit code lower the probability of opportunistic mass exploitation today, but the low barrier to exploitation (a single forged HTTP POST) means risk rises sharply for any internet-facing PraisonAI bot instance that hasn't set both secrets.

How does the attack unfold?

Initial Access

Attacker sends an unauthenticated HTTP POST directly to the exposed WhatsApp or Linear webhook route, bypassing any need for credentials.

AML.T0049

Forgery

Because no signature secret is configured, the handler skips HMAC verification and parses the attacker's crafted payload as if it came from the legitimate platform.

AML.T0093

Agent Manipulation

The forged message/comment/session event is dispatched into the agent's context, impersonating a trusted user and influencing the agent's prompts and subsequent actions.

AML.T0080.001

Impact

The bot acts on attacker-controlled input — replying with misleading content, triggering unintended workflows, or having its normal processing disrupted — without the operator's knowledge.

AML.T0073

Initial Access

Attacker sends an unauthenticated HTTP POST directly to the exposed WhatsApp or Linear webhook route, bypassing any need for credentials.

AML.T0049

Forgery

Because no signature secret is configured, the handler skips HMAC verification and parses the attacker's crafted payload as if it came from the legitimate platform.

AML.T0093

Agent Manipulation

The forged message/comment/session event is dispatched into the agent's context, impersonating a trusted user and influencing the agent's prompts and subsequent actions.

AML.T0080.001

Impact

The bot acts on attacker-controlled input — replying with misleading content, triggering unintended workflows, or having its normal processing disrupted — without the operator's knowledge.

AML.T0073

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
PraisonAI Agents	pip	—	No patch
20 dependents 59% patched ~6d to patch Full package profile →

How severe is it?

CVSS 3.1

8.6 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 3% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C Low

I High

A Low

What should I do?

1 step

1) Upgrade to PraisonAI >= 4.6.59, which enforces signature verification unconditionally. 2) Until patched, always configure WHATSAPP_APP_SECRET and LINEAR_WEBHOOK_SECRET in every deployment — never leave webhook routes running without them. 3) Restrict network reachability of the webhook endpoints (allow-list the messaging platform's IP ranges / use a reverse proxy) as defense-in-depth. 4) Add monitoring/alerting for webhook requests that fail or lack signature validation, and review recent agent-session logs for anomalous or unverifiable events if the secrets were previously unset. 5) Rotate webhook secrets after patching in case they were exposed or guessed.

How is it classified?

Auth Bypass Prompt Injection Social Engineering Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0073 - Impersonation AML.T0080.001 - Thread AML.T0093 - Prompt Infiltration via Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security controls

NIST AI RMF

MEASURE 2.6 - AI system security and resilience is evaluated

OWASP LLM Top 10

LLM07 - Insecure Plugin/Integration Design

Frequently Asked Questions

What is CVE-2026-57122?

PraisonAI's WhatsApp and Linear webhook handlers only verify the HMAC signature when WHATSAPP_APP_SECRET or LINEAR_WEBHOOK_SECRET is set in the environment; if either secret is absent, the handler still parses and dispatches the incoming request body as trusted input. A remote, unauthenticated attacker who can reach the webhook route can therefore forge chat messages, Linear comments, or agent-session events, impersonate real platform users, and feed attacker-controlled content directly into the agent's decision loop, with a CVSS 3.1 score of 8.6 (network, no auth, no user interaction, high integrity impact). There is no evidence of active exploitation — it is not in CISA KEV, EPSS data is unavailable, and no public exploit or scanner template exists — so this looks like an unweaponized configuration-dependent flaw rather than an imminent mass-exploitation risk, but any deployment that omitted the secret env vars (a plausible default in quick setups) is exposed today. Patch to PraisonAI 4.6.59 or later immediately; as an interim workaround, ensure WHATSAPP_APP_SECRET and LINEAR_WEBHOOK_SECRET are always set (never leave them unconfigured) or block unauthenticated traffic to the webhook route at the network/reverse-proxy layer. Detection: audit webhook logs for requests missing a valid signature header and alert on any bot actions triggered by unsigned payloads.

Is CVE-2026-57122 actively exploited?

No confirmed active exploitation of CVE-2026-57122 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-57122?

1) Upgrade to PraisonAI >= 4.6.59, which enforces signature verification unconditionally. 2) Until patched, always configure WHATSAPP_APP_SECRET and LINEAR_WEBHOOK_SECRET in every deployment — never leave webhook routes running without them. 3) Restrict network reachability of the webhook endpoints (allow-list the messaging platform's IP ranges / use a reverse proxy) as defense-in-depth. 4) Add monitoring/alerting for webhook requests that fail or lack signature validation, and review recent agent-session logs for anomalous or unverifiable events if the secrets were previously unset. 5) Rotate webhook secrets after patching in case they were exposed or guessed.

What systems are affected by CVE-2026-57122?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, webhook/event-driven integrations, multi-agent orchestration.

What is the CVSS score for CVE-2026-57122?

CVE-2026-57122 has a CVSS v3.1 base score of 8.6 (HIGH). The EPSS exploitation probability is 0.13%.

What is the AI security impact?

Affected AI Architectures

agent frameworkswebhook/event-driven integrationsmulti-agent orchestration

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0073 Impersonation

AML.T0080.001 Thread

AML.T0093 Prompt Infiltration via Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.6

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPP_APP_SECRET or LINEAR_WEBHOOK_SECRET is configured and otherwise parse and dispatch unsigned request bodies. A remote unauthenticated client that reaches the webhook route can forge messages, comments, or agent-session events, impersonate platform users, influence agent prompts and actions, and disrupt bot processing. This issue is fixed in 4.6.59.

Exploitation Scenario

An attacker discovers a PraisonAI-based support or ops bot exposed at a public webhook URL where the operator never set LINEAR_WEBHOOK_SECRET (a common oversight during quick setup). The attacker crafts a raw HTTP POST mimicking a Linear 'comment created' event, impersonating a trusted engineer and instructing the agent to perform an action (e.g., close a ticket, trigger an automated workflow, or reply with misleading guidance) or floods the endpoint with malformed events to disrupt legitimate bot processing — all without needing any credentials or prior access to Linear or WhatsApp.

Weaknesses (CWE)

CWE-345 Insufficient Verification of Data Authenticity Primary CWE-347 Improper Verification of Cryptographic Signature Primary CWE-345 Insufficient Verification of Data Authenticity CWE-347 Improper Verification of Cryptographic Signature

CWE-345 — Insufficient Verification of Data Authenticity: The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Source: MITRE CWE corpus.