EUVD-2026-43177
GHSA-4mp6-8448-9vgv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, unauthenticated POST with no complexity; limited C/I/A impact as no code execution or full data access is achieved.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
PraisonAI AgentMail versions before 4.6.78 lack signature verification in webhook mode, allowing unauthenticated attackers to inject messages with spoofed sender addresses. Attackers can POST crafted message.received events to the webhook endpoint to inject arbitrary content into the agent and trigger replies to attacker-controlled addresses, bypassing sender allow/block lists.
AnalysisAI
Webhook signature verification is absent in PraisonAI AgentMail before version 4.6.78, permitting any unauthenticated network attacker to POST crafted message.received events directly to the webhook endpoint with spoofed sender identities. This bypasses configured sender allow/block lists, injecting arbitrary content into the AI agent's processing pipeline and causing the agent to dispatch replies to attacker-controlled addresses. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, though the low-complexity, unauthenticated attack vector makes exploitation straightforward for any attacker with network access to the webhook endpoint.
Technical ContextAI
PraisonAI is an open-source multi-agent AI framework (CPE: cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:*); AgentMail is its email-processing component that operates in webhook mode, receiving inbound email events from a mail provider via HTTP POST callbacks. Standard webhook security practice requires the receiving service to validate an HMAC cryptographic signature included in the request header - a secret shared between the mail provider and the receiving application - to confirm the event originated from a legitimate source. CWE-290 (Authentication Bypass by Spoofing) precisely describes the root cause: the absence of this signature check means any party who can reach the webhook URL can impersonate the mail provider, constructing a message.received payload with a fabricated sender address. Because the agent trusts injected sender metadata, configured allow/block list controls are rendered ineffective, and the agent's response logic - including outbound reply generation - operates on adversary-supplied content.
RemediationAI
Upgrade PraisonAI AgentMail to version 4.6.78 or later, which is confirmed as the fixed release per the vendor's GitHub Security Advisory GHSA-qj9c-59p6-8cgx at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qj9c-59p6-8cgx. For deployments that cannot upgrade immediately, restrict network-level access to the webhook endpoint using firewall rules or API gateway IP allowlisting to permit connections only from the legitimate mail provider's published IP ranges - this directly removes unauthenticated public access and significantly reduces exposure, though it adds operational overhead when provider IP ranges change. As a secondary compensating control, disable webhook mode and switch to authenticated polling mode if the mail provider supports it; this eliminates the vulnerable code path entirely at the cost of near-real-time event delivery. Generic 'defense-in-depth' controls such as WAFs are insufficient substitutes because the malicious payload is a structurally valid HTTP POST.
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an att
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can inf
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to ex
Remote unauthenticated access to PraisonAI's legacy Flask API server allows attackers to execute configured agent workfl
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the appl
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today