CVE-2026-61436: PraisonAI missing webhook signature

CISO Take

PraisonAI's AgentMail webhook integration fails to verify Svix signatures, so anyone who finds the endpoint can POST a forged "message.received" JSON payload and trigger a configured agent with a fabricated sender address and arbitrary message content — no credentials, no user interaction, and low attack complexity (CVSS 8.6, AV:N/AC:L/PR:N/UI:N). Only one downstream dependent is currently tracked, and there's no EPSS score, no CISA KEV listing, no public exploit, and no Nuclei template, so there's no evidence of active mass exploitation today — but the flaw itself is trivial to weaponize once an attacker locates a live webhook URL, and the integrity impact is rated high because it lets an outsider impersonate trusted senders and steer agent behavior. Treat this as a same-week patch: upgrade to PraisonAI 4.6.78+ per GHSA-7c92-x8vg-4258, and if you can't patch immediately, restrict the webhook endpoint to Svix's egress IP ranges or add a reverse-proxy signature check as a stopgap. Audit logs for message.received events whose sender doesn't match your legitimate AgentMail correspondents — that's the clearest indicator of attempted spoofing.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Network-exploitable, zero-privilege, zero-interaction auth bypass (CWE-287) with high integrity impact — an attacker doesn't need to compromise credentials or infrastructure, only discover the exposed webhook URL and send a well-formed unsigned JSON payload. The lack of an EPSS score, KEV listing, public PoC, or scanner template suggests exploitation isn't yet automated or widespread, and the tracked blast radius (1 downstream dependent, package risk score 0/100) is narrow today. However, the exploit primitive is simple enough that weaponization requires no AI/ML expertise, only knowledge of the Svix webhook contract — so risk should be treated as high despite low current telemetry, and reassessed if exploit code or scanning activity appears.

How does the attack unfold?

Entry point

Attacker locates the publicly exposed PraisonAI AgentMail webhook endpoint.

AML.T0049

Forge event

Attacker crafts an unsigned JSON payload mimicking a Svix message.received event with a spoofed sender and arbitrary content.

AML.T0093

Unauthorized invocation

Because signatures aren't verified, the server accepts the payload and invokes the configured agent with attacker-controlled input.

AML.T0053

Impact

The agent acts on the forged, impersonated message, potentially triggering unauthorized actions or trusting attacker-supplied content as legitimate.

AML.T0073

Entry point

Attacker locates the publicly exposed PraisonAI AgentMail webhook endpoint.

AML.T0049

Forge event

Attacker crafts an unsigned JSON payload mimicking a Svix message.received event with a spoofed sender and arbitrary content.

AML.T0093

Unauthorized invocation

Because signatures aren't verified, the server accepts the payload and invokes the configured agent with attacker-controlled input.

AML.T0053

Impact

The agent acts on the forged, impersonated message, potentially triggering unauthorized actions or trusting attacker-supplied content as legitimate.

AML.T0073

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents 69% patched ~13d to patch Full package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

8.6 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 42% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C Low

I High

A Low

What should I do?

1 step

1) Upgrade to PraisonAI >= 4.6.78, which adds Svix signature verification per the referenced patch commits (846568c, 2a855c4). 2) If immediate upgrade isn't possible, restrict inbound traffic to the webhook route to Svix's published egress IP ranges via firewall/reverse-proxy ACL. 3) Add an interim signature-verification shim in front of the webhook (validate the svix-signature/svix-timestamp headers against your webhook secret) if patching is delayed. 4) Review which tools/actions the configured AgentMail agent can invoke and apply least-privilege scoping so a spoofed trigger can't cascade into a high-impact action. 5) Alert/monitor on message.received events with senders outside your known correspondent list as a detection signal for exploitation attempts.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Social Engineering Agent API AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0073 - Impersonation AML.T0093 - Prompt Infiltration via Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6 - AI system operation and monitoring

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-61436?

PraisonAI's AgentMail webhook integration fails to verify Svix signatures, so anyone who finds the endpoint can POST a forged "message.received" JSON payload and trigger a configured agent with a fabricated sender address and arbitrary message content — no credentials, no user interaction, and low attack complexity (CVSS 8.6, AV:N/AC:L/PR:N/UI:N). Only one downstream dependent is currently tracked, and there's no EPSS score, no CISA KEV listing, no public exploit, and no Nuclei template, so there's no evidence of active mass exploitation today — but the flaw itself is trivial to weaponize once an attacker locates a live webhook URL, and the integrity impact is rated high because it lets an outsider impersonate trusted senders and steer agent behavior. Treat this as a same-week patch: upgrade to PraisonAI 4.6.78+ per GHSA-7c92-x8vg-4258, and if you can't patch immediately, restrict the webhook endpoint to Svix's egress IP ranges or add a reverse-proxy signature check as a stopgap. Audit logs for message.received events whose sender doesn't match your legitimate AgentMail correspondents — that's the clearest indicator of attempted spoofing.

Is CVE-2026-61436 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-61436, increasing the risk of exploitation.

How to fix CVE-2026-61436?

1) Upgrade to PraisonAI >= 4.6.78, which adds Svix signature verification per the referenced patch commits (846568c, 2a855c4). 2) If immediate upgrade isn't possible, restrict inbound traffic to the webhook route to Svix's published egress IP ranges via firewall/reverse-proxy ACL. 3) Add an interim signature-verification shim in front of the webhook (validate the `svix-signature`/`svix-timestamp` headers against your webhook secret) if patching is delayed. 4) Review which tools/actions the configured AgentMail agent can invoke and apply least-privilege scoping so a spoofed trigger can't cascade into a high-impact action. 5) Alert/monitor on message.received events with senders outside your known correspondent list as a detection signal for exploitation attempts.

What systems are affected by CVE-2026-61436?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, webhook-triggered agent pipelines.

What is the CVSS score for CVE-2026-61436?

CVE-2026-61436 has a CVSS v3.1 base score of 8.6 (HIGH). The EPSS exploitation probability is 0.52%.

What is the AI security impact?

Affected AI Architectures

agent frameworkswebhook-triggered agent pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0073 Impersonation

AML.T0093 Prompt Infiltration via Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke configured agents with arbitrary sender addresses and message content.

Exploitation Scenario

An attacker scans for or otherwise identifies a publicly reachable PraisonAI AgentMail webhook endpoint. Without needing any credentials, they craft a JSON payload mimicking a legitimate Svix `message.received` event, setting the sender field to impersonate a trusted contact and embedding arbitrary text in the message body — potentially including prompt-injection style instructions. They POST this payload directly to the webhook; since no signature is verified, PraisonAI processes it as authentic and invokes the configured agent with the attacker's forged sender and content, causing the agent to act on unverified, attacker-controlled input as if it came from a legitimate source.

Weaknesses (CWE)

CWE-287 Improper Authentication CWE-287 Improper Authentication

CWE-287 — Improper Authentication: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.