CVE-2026-57122: PraisonAI Authentication Bypass Vulnerability

CVE-2026-57122 Overview

CVE-2026-57122 is a webhook signature verification flaw in PraisonAI, a multi-agent teams system. Versions prior to 4.6.59 verify HMAC signatures on WhatsApp and Linear bot webhooks only when WHATSAPP_APP_SECRET or LINEAR_WEBHOOK_SECRET is configured. When either secret is unset, the handlers parse and dispatch unsigned request bodies without validation. Remote unauthenticated attackers reaching the webhook route can forge messages, comments, and agent-session events, impersonate platform users, and influence agent prompts and actions. The issue is classified under [CWE-345: Insufficient Verification of Data Authenticity] and is fixed in version 4.6.59.

Critical Impact
Unauthenticated remote attackers can inject forged webhook events into PraisonAI agent workflows, hijacking agent behavior and impersonating platform users.

Affected Products

PraisonAI versions prior to 4.6.59
WhatsApp bot webhook handler when WHATSAPP_APP_SECRET is unset
Linear bot webhook handler when LINEAR_WEBHOOK_SECRET is unset

Discovery Timeline

2026-09-14 - CVE-2026-57122 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-57122

Vulnerability Analysis

PraisonAI exposes webhook endpoints for WhatsApp and Linear integrations that drive downstream agent behavior. The handlers execute HMAC signature checks conditionally, gating verification on the presence of environment-configured secrets. When operators deploy PraisonAI without setting WHATSAPP_APP_SECRET or LINEAR_WEBHOOK_SECRET, the webhook handlers accept any request body reaching the route and dispatch it into agent processing pipelines.

Any remote client that can reach the webhook URL can submit crafted payloads that PraisonAI treats as authentic platform events. Forged events feed directly into agent prompts, session state, and downstream tool invocations. This gives attackers a pathway to influence agent decisions, impersonate legitimate users in comments or messages, and disrupt bot processing.

Root Cause

The root cause is a fail-open authentication design. The handlers treat a missing secret as a signal to skip verification rather than as a misconfiguration that should reject traffic. This inverts the secure default and exposes the webhook route to unauthenticated forgery whenever secrets are absent.

Attack Vector

Exploitation requires only network access to the webhook endpoint. No authentication, user interaction, or prior privileges are needed. An attacker sends a POST request that mimics a WhatsApp or Linear event payload, and the handler dispatches it into the agent workflow.

python

# Patch excerpt: hardened approval registry check
# src/praisonai-agents/praisonaiagents/approval/registry.py
def is_yaml_approved(self, tool_name: str) -> bool:
    try:
        if tool_name not in self._yaml_approved_tools.get():
            return False
    except LookupError:
        return False
    if self.get_risk_level(tool_name) == "critical":
        return False
    return True

Source: GitHub Commit 2adfe7e

Detection Methods for CVE-2026-57122

Indicators of Compromise

Inbound POST requests to WhatsApp or Linear webhook routes lacking valid HMAC signature headers such as X-Hub-Signature-256 or Linear-Signature.
Agent session events, messages, or comments originating from user identifiers that do not correlate with authenticated platform activity.
Unexpected agent tool invocations or prompt content triggered immediately after webhook receipt from unknown source IPs.

Detection Strategies

Enable request logging on the reverse proxy or application server fronting PraisonAI and alert on webhook requests with missing or malformed signature headers.
Correlate webhook payload user IDs with platform-side audit logs from WhatsApp Business API and Linear to identify impersonation.
Monitor PraisonAI logs for agent-session events that reference conversations or tickets absent from upstream platform records.

Monitoring Recommendations

Deploy network filtering to restrict webhook route access to known WhatsApp and Linear egress IP ranges.
Track deployment configuration to detect PraisonAI instances running without WHATSAPP_APP_SECRET or LINEAR_WEBHOOK_SECRET set.
Instrument alerting on spikes in webhook request volume or agent action rates outside baseline patterns.

How to Mitigate CVE-2026-57122

Immediate Actions Required

Upgrade PraisonAI to version 4.6.59 or later, which enforces mandatory HMAC signature verification on webhook handlers.
Configure WHATSAPP_APP_SECRET and LINEAR_WEBHOOK_SECRET in every deployment before exposing webhook routes to the internet.
Rotate any secrets that may have been in use during the vulnerable window and review agent session logs for suspicious activity.

Patch Information

The fix is available in PraisonAI v4.6.59. Full technical details are documented in GHSA-x92v-rpx6-p6cw and the remediation commit.

Workarounds

Place PraisonAI webhook endpoints behind an authenticating reverse proxy that enforces HMAC verification before requests reach the application.
Restrict webhook route exposure using firewall or ingress rules that permit only WhatsApp and Linear source IP ranges.
Disable the WhatsApp and Linear bot handlers entirely until the deployment is upgraded and secrets are configured.

bash

# Configuration example: set required webhook secrets before deploying
export WHATSAPP_APP_SECRET="$(openssl rand -hex 32)"
export LINEAR_WEBHOOK_SECRET="$(openssl rand -hex 32)"

# Verify the installed version is patched
pip show praisonai | grep -i version
# Expected: Version: 4.6.59 or higher