PraisonAI LinearBot: Missing authentication of Linear webhooks
Summary
PraisonAI LinearBot accepts unsigned Linear webhook requests when the environment variable LINEAR_WEBHOOK_SECRET is not set. The webhook listener binds to 0.0.0.0, so any network caller that can reach it can send forged AgentSession events. This invokes the configured agent and lets it post responses to Linear under the bot token. The attack requires a deployed LinearBot without a webhook secret and a reachable listener.
Affected
- PraisonAI (pip package praisonai) from 4.6.56 up to and including 4.6.58
- Component: LinearBot (praisonai bot linear)
Fixed in
- Fixed in PraisonAI 4.6.59 and later
Workaround
- Set LINEAR_WEBHOOK_SECRET to the Linear webhook signing secret so that signatures are verified
- Restrict access to the webhook port with a firewall or reverse proxy allowlist
- Unknown: no official workaround besides upgrading or setting the secret has been published
Exploitation
- No evidence of exploitation in the wild found
- Not listed in CISA KEV
- CISA SSVC: Exploitation none, automatable yes
- EPSS 0.00188 (very low)
- The vendor references an offline proof-of-concept script that does not contact Linear; its contents were not verified
Our recommendation
- Check whether PraisonAI LinearBot is deployed (praisonai bot linear)
- Upgrade to PraisonAI 4.6.59 or later
- Until upgraded, set LINEAR_WEBHOOK_SECRET and do not expose the webhook port to untrusted networks
- Review agent activity and Linear comments for unexpected entries
- Check other PraisonAI bot integrations for similar webhook issues
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-fc26-m9pf-v56q github.com
- OSV: GHSA-fc26-m9pf-v56q osv.dev
- NVD mirror on Vulners: CVE-2026-56837 vulners.com
- VulDB 425677 vuldb.com
- EUVD-2026-108878 on Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:12.
Original description (NVD)
PraisonAI is a multi-agent teams system. From version 4.6.56 to before version 4.6.59, PraisonAI's LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEAR_WEBHOOK_SECRET as optional. When the secret is absent, startup only logs a warning and _handle_webhook() skips Linear-Signature verification entirely. An unauthenticated network caller who can reach the webhook endpoint can submit a forged Linear-Event: AgentSession request. The forged request is parsed, scheduled for background processing, dispatched to _handle_agent_session(), and passed into BotSessionManager.chat(). The bot then attempts to post the agent response back to Linear under the configured bot token. The PoV is offline and deterministic. It does not contact Linear. It calls the webhook handler directly, monkey-patches the outbound Linear comment path, and proves both sides of the boundary. This issue has been patched in version 4.6.59.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.