CVE-2026-56837

PraisonAI is a multi-agent teams system. From version 4.6.56 to before version 4.6.59, PraisonAI's LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEAR_WEBHOOK_SECRET as optional. When the secret is absent, startup only logs a warning and _handle_webhook() skips Linear-Signature verification entirely. An unauthenticated network caller who can reach the webhook endpoint can submit a forged Linear-Event: AgentSession request. The forged request is parsed, scheduled for background processing, dispatched to _handle_agent_session(), and passed into BotSessionManager.chat(). The bot then attempts to post the agent response back to Linear under the configured bot token. The PoV is offline and deterministic. It does not contact Linear. It calls the webhook handler directly, monkey-patches the outbound Linear comment path, and proves both sides of the boundary. This issue has been patched in version 4.6.59.

• CWE-287
• CWE-306
• CWE-347

• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-fc26-m9pf-v56q

Published

Oct 23, 2026

Last Modified

Oct 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-56831Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0…6.5
• CVE-2026-56832PraisonAI is a multi-agent teams system. From version 4.5.2 …8.8
• CVE-2026-56833PraisonAI is a multi-agent teams system. From version 3.8.1 …7.5
• CVE-2026-56834PraisonAI is a multi-agent teams system. From version 3.8.1 …7.5
• CVE-2026-56835PraisonAI is a multi-agent teams system. From version 3.11.0…8.3
• CVE-2026-56836PraisonAI is a multi-agent teams system. From version 4.5.11…8.2
• CVE-2026-56838PraisonAI is a multi-agent teams system. From version 4.5.87…7.8
• CVE-2026-56839PraisonAI is a multi-agent teams system. Prior to 4.6.59, th…7.3
• CVE-2026-5684A vulnerability was determined in Tenda CX12L 16.03.53.12. A…8
• CVE-2026-56840PraisonAI is a multi-agent teams system. From version 4.5.2 …8.8
• CVE-2026-56841A malicious actor with access to the network and low privile…8.8
• CVE-2026-56842A malicious actor with access to the network and under certa…7.5