PT-2026-61762 · Praisonai · Praisonai
CVE-2026-56837
·
Published
2026-06-18
·
Updated
2026-07-23
CVSS v3.1
8.6
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
praisonai version 4.5.50
praisonai versions 4.6.56 through 4.6.58
Description
LinearBot starts a public webhook listener on
0.0.0.0 and treats the LINEAR WEBHOOK SECRET as optional. When this secret is missing, the handle webhook() function skips the verification of the Linear-Signature header. This allows an unauthenticated network caller to submit forged requests, such as those with the Linear-Event: AgentSession header, which are then processed by handle agent session() and passed to BotSessionManager.chat(). Consequently, an attacker can spoof Linear webhook events to invoke the configured agent, potentially leading to unauthorized LLM or tool execution, consumption of paid model quotas, and the creation of unauthorized Linear comments under the bot's identity.Recommendations
For version 4.5.50, refuse to start LinearBot when
LINEAR WEBHOOK SECRET is missing or reject requests in handle webhook() when no signing secret is configured.
For versions 4.6.56 through 4.6.58, refuse to start LinearBot when LINEAR WEBHOOK SECRET is missing or reject requests in handle webhook() when no signing secret is configured.
As a temporary mitigation, restrict access to the webhook endpoint or ensure LINEAR WEBHOOK SECRET is strictly configured to enable HMAC-SHA256 verification.Fix
Improper Authentication
Missing Authentication
Improper Verification of Cryptographic Signature
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Praisonai