CVE-2026-61436: PraisonAI Auth Bypass Vulnerability

CVE-2026-61436 Overview

CVE-2026-61436 affects PraisonAI versions before 4.6.78. The framework fails to verify Svix webhook signatures when running in AgentMail webhook mode. Unauthenticated attackers can forge message.received events by sending crafted JSON payloads directly to the webhook endpoint. This allows adversaries to invoke configured agents using arbitrary sender addresses and message content, bypassing the intended trust boundary between AgentMail and the PraisonAI runtime. The weakness is classified under [CWE-287] Improper Authentication.

Critical Impact
Unauthenticated remote attackers can forge inbound email events to trigger PraisonAI agents with attacker-controlled sender identity and message content.

Affected Products

PraisonAI versions prior to 4.6.78
Deployments using AgentMail webhook mode
Docker images built from Dockerfile.chat and Dockerfile.dev pinning praisonai>=4.6.60

Discovery Timeline

2026-07-15 - CVE-2026-61436 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-61436

Vulnerability Analysis

PraisonAI integrates with AgentMail through an inbound webhook that receives message.received events. Svix, the webhook delivery service used by AgentMail, signs each request with an HMAC signature that receivers must validate. In vulnerable releases, the PraisonAI webhook handler accepts the JSON payload without verifying the svix-id, svix-timestamp, and svix-signature headers. Any network-reachable client can therefore submit forged events. The agent then processes the payload as if it originated from a trusted email sender, executing whatever workflow is bound to the message.received handler.

Root Cause

The root cause is missing cryptographic verification of the webhook request. The endpoint deserializes the request body and dispatches it to agent logic without validating the HMAC signature against the shared Svix secret. As a result, the server treats attacker-controlled input as authenticated event data. This is a classic authentication-of-source failure [CWE-287].

Attack Vector

Exploitation requires only network access to the exposed webhook route. An attacker crafts a JSON body mimicking a legitimate message.received event, including a chosen from address and message body, and issues a POST request to the endpoint. Because no signature check occurs, the request is accepted. The forged sender identity can be used to bypass sender-based allowlists, trigger downstream tool calls, or drive the agent to exfiltrate data, send outbound messages, or invoke integrated APIs.

text

# Patch reference: docker/Dockerfile.chat (v4.6.62)
 RUN pip install --no-cache-dir \
     praisonai_tools \
-    "praisonai>=4.6.60" \
+    "praisonai>=4.6.62" \
     "praisonai[chat]" \
     "embedchain[github,youtube]"

Source: GitHub Commit 2a855c4

The fixed release line moves base images from praisonai>=4.6.60 toward the corrected series; operators must upgrade to at least 4.6.78 for the signature verification fix. Additional server-side hardening around workspace resource validation was introduced in the platform API (api/deps.py and api/routes/issues.py) in the related commit 846568c.

Detection Methods for CVE-2026-61436

Indicators of Compromise

POST requests to the AgentMail webhook path lacking svix-id, svix-timestamp, or svix-signature headers.
Requests bearing Svix headers whose HMAC does not validate against the configured secret.
Agent invocations referencing sender email domains not present in prior legitimate AgentMail traffic.
Unexpected outbound tool calls or API activity immediately following a webhook POST from an unfamiliar source IP.

Detection Strategies

Enable webhook access logging and alert on requests to the AgentMail endpoint that omit Svix headers.
Correlate webhook receipt with source IP reputation, flagging non-Svix source ranges.
Diff sender addresses observed in webhook payloads against the historical AgentMail sender baseline.
Instrument the agent runtime to log the raw signature-verification result for each inbound event.

Monitoring Recommendations

Forward webhook and agent execution logs to a centralized SIEM for retention and correlation.
Track rate of message.received events per source IP and alert on bursts from a single origin.
Monitor outbound actions triggered by agents for anomalies such as unusual recipients or tool arguments.

How to Mitigate CVE-2026-61436

Immediate Actions Required

Upgrade PraisonAI to version 4.6.78 or later on all hosts and container images.
Rotate the Svix webhook signing secret after upgrading to invalidate any secrets that may have been exposed.
Restrict inbound network access to the AgentMail webhook endpoint to Svix-published source ranges where feasible.
Audit recent agent invocations for message.received events with unexpected sender addresses.

Patch Information

The vulnerability is fixed in PraisonAI 4.6.78. See the GitHub Security Advisory GHSA-7c92-x8vg-4258 and the VulnCheck Advisory for full disclosure details. Related upstream commits are 2a855c4 and 846568c.

Workarounds

If immediate upgrade is not possible, place the webhook endpoint behind a reverse proxy that validates the Svix HMAC signature before forwarding requests.
Disable AgentMail webhook mode until the patched release can be deployed.
Enforce IP allowlisting so only known Svix delivery ranges can reach the webhook path.

bash

# Upgrade PraisonAI to the fixed version
pip install --upgrade "praisonai>=4.6.78"

# Verify installed version
python -c "import praisonai; print(praisonai.__version__)"