PraisonAI LinearBot CVE-2026-56837

The decisive prerequisite is that LinearBot is started without LINEAR_WEBHOOK_SECRET configured (the secret is treated as optional and defaults to an empty string), causing _handle_webhook() to skip Linear-Signature HMAC verification entirely - this is the fail-open condition. The operator must additionally have launched LinearBot with a valid Linear bot token, and the webhook listener must be network-reachable since it binds 0.0.0.0 on the configured webhook port. Exploitation targets the AgentSession event path specifically. Limiting factors that reduce real-world risk: if LINEAR_WEBHOOK_SECRET IS set, missing and invalid signatures are rejected with 401 before any agent dispatch, so correctly configured deployments are not exploitable; the listener must be reachable by the attacker (network segmentation or loopback-only exposure blocks it); and the concrete impact depends on which agent and tools are configured - the advisory explicitly does not claim arbitrary code execution by default, only unauthenticated remote agent invocation.

The raw signals point in two directions. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes an unauthenticated, low-complexity, remote, no-interaction flaw - on paper a top-priority issue, scored 8.6. However, exploitation is strictly gated by an operator misconfiguration: it only applies when LinearBot is started with a Linear token but with LINEAR_WEBHOOK_SECRET absent, which makes the handler fail open. This is a conditional exposure, not a default-config remote hole, so the PR:N in the vector reflects that no attacker credentials are needed once the misconfiguration exists - it does not mean every deployment is exposed. The vuln.today Decision label is 'this_week' (not act_now/emergency), which is consistent with a serious but non-emergency item. No EPSS score and no CISA KEV entry are present in the input, and no SSVC exploitation/automatable/technical-impact breakdown is provided beyond the decision label - so widespread or automated exploitation is neither confirmed nor refuted. A deterministic offline PoV is described in the GHSA advisory, demonstrating the boundary crossing, but it is not provided here as confirmed, publicly posted working exploit code. Net assessment: a real priority for any operator who runs LinearBot without the signing secret, but the population at risk is bounded by that specific misconfiguration and by the niche footprint of the product; teams running LinearBot with the secret set are unaffected. Note also that the CVSS I:H is arguably generous - impact is unauthorized agent invocation and comment creation under the bot token plus quota consumption, which some assessors would rate lower; verify against your agent/tool configuration.

An operator runs PraisonAI's LinearBot with a valid Linear bot token but omits LINEAR_WEBHOOK_SECRET, so the webhook listener binds 0.0.0.0 and skips signature verification. An unauthenticated attacker who can reach that port sends a forged 'Linear-Event: AgentSession' request with attacker-chosen issue title and description; because no secret is configured the Linear-Signature check is bypassed, the agent processes the attacker's input and posts a response back to Linear under the bot identity while consuming paid model quota. A deterministic offline PoV demonstrating this path is described in the vendor advisory.