CVE-2026-61428: PraisonAI AgentMail Auth Bypass Vulnerability

CVE-2026-61428 Overview

CVE-2026-61428 affects PraisonAI AgentMail versions before 4.6.78. The vulnerability stems from missing signature verification on the webhook endpoint that processes inbound message.received events. Unauthenticated attackers can POST crafted webhook payloads with spoofed sender addresses, injecting arbitrary content into the agent. Successful exploitation bypasses sender allow and block lists, and can trigger the agent to reply to attacker-controlled addresses. The weakness is classified under CWE-290: Authentication Bypass by Spoofing.

Critical Impact
Unauthenticated remote attackers can spoof inbound email events, inject arbitrary content into AI agents, and coerce them into replying to attacker-controlled addresses.

Affected Products

PraisonAI AgentMail versions prior to 4.6.78
Deployments running AgentMail in webhook mode
Agents configured to auto-reply to inbound message.received events

Discovery Timeline

2026-07-11 - CVE-2026-61428 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-61428

Vulnerability Analysis

PraisonAI AgentMail exposes an HTTP webhook endpoint to receive inbound message events from upstream mail providers. In webhook mode, the service processes message.received events and passes their contents into the agent pipeline. The affected versions accept these events without validating a shared secret, HMAC signature, or other cryptographic proof of origin.

Because the endpoint trusts the request body implicitly, any actor able to reach it can submit forged events. The agent treats spoofed sender values as authentic identities. This defeats downstream trust decisions, including allow list and block list enforcement that gates whether the agent processes or replies to a message.

Injected content can steer agent behavior, exfiltrate data through reply channels, or route responses to attacker-controlled addresses. The impact is bounded to the agent's reply and processing scope, which aligns with the low confidentiality, integrity, and availability sub-scores in the CVSS v4.0 vector. EPSS currently rates exploitation probability at 0.246% (15.86 percentile).

Root Cause

The root cause is missing origin authentication on the webhook handler. AgentMail does not verify a signature header, shared secret, or mutual TLS certificate before accepting message.received payloads. This is a classic [CWE-290] failure where identity is asserted by request content rather than proven cryptographically.

Attack Vector

An attacker sends an HTTP POST request to the exposed AgentMail webhook URL. The body mimics a legitimate message.received event and sets the sender field to an address on the agent's allow list. The agent parses the event, applies its normal processing logic, and may generate a reply directed to any address supplied in the forged payload. No authentication, credentials, or user interaction are required.

Because no verified proof-of-concept has been published, technical exploitation details are described in prose. See the GitHub Security Advisory GHSA-qj9c-59p6-8cgx and the VulnCheck Advisory for the vendor's technical description.

Detection Methods for CVE-2026-61428

Indicators of Compromise

Unexpected POST requests to the AgentMail webhook path from IP ranges outside your mail provider's documented egress list
message.received events whose sender domain matches your allow list but whose source IP does not match the provider
Agent reply logs showing outbound messages to previously unseen recipient addresses shortly after inbound webhook activity

Detection Strategies

Compare the source IP of each webhook request against the mail provider's published sender IP ranges and alert on mismatches
Log every inbound webhook payload with request headers, and flag requests missing the expected signature header once signing is available
Correlate inbound message.received events with the corresponding provider-side message ID to detect events with no upstream counterpart

Monitoring Recommendations

Instrument the webhook endpoint with structured logging that captures sender, recipient, message ID, and remote address
Alert on agent replies routed to external domains not previously contacted by the mailbox
Monitor for surges in webhook POST volume or malformed payload patterns indicative of automated probing

How to Mitigate CVE-2026-61428

Immediate Actions Required

Upgrade PraisonAI AgentMail to version 4.6.78 or later, which introduces webhook signature verification
Restrict network access to the webhook endpoint so only the mail provider's egress IP ranges can reach it
Audit recent webhook logs and agent reply history for spoofed sender activity while the upgrade is planned

Patch Information

The vendor addressed the issue in PraisonAI AgentMail 4.6.78. Refer to the GitHub Security Advisory GHSA-qj9c-59p6-8cgx for the fix commit and configuration guidance on enabling signature verification.

Workarounds

Terminate the webhook behind a reverse proxy that enforces an IP allow list restricted to the mail provider's documented ranges
Require a static bearer token or mutual TLS on the reverse proxy until the signed-webhook upgrade is deployed
Disable agent auto-reply for inbound events sourced from the webhook path until verification is in place

bash

# Example nginx allow list restricting webhook access to provider egress ranges
location /agentmail/webhook {
    allow 192.0.2.0/24;   # replace with provider egress range
    allow 198.51.100.0/24;
    deny all;

    proxy_pass http://agentmail_backend;
    proxy_set_header X-Forwarded-For $remote_addr;
}