EUVD-2026-44642
GHSA-m64w-vfg6-36ph
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network POST bypasses the signature check (AV:N/AC:L/PR:N/UI:N); forged events chiefly corrupt agent integrity (I:H) with limited confidentiality/availability exposure (C:L/A:L).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke configured agents with arbitrary sender addresses and message content.
AnalysisAI
Webhook signature-verification bypass in PraisonAI before 4.6.78 lets unauthenticated attackers forge Svix 'message.received' events when the framework runs in AgentMail webhook mode. Because incoming payloads are trusted without validating the Svix signature (CWE-287), an attacker can POST crafted JSON to the webhook endpoint and cause configured agents to process attacker-chosen sender addresses and message bodies. A vendor patch exists (4.6.78); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
PraisonAI (CPE cpe:2.3:a:mervinpraison:praisonai) is an open-source multi-agent AI orchestration framework. In AgentMail webhook mode it exposes an HTTP endpoint that receives inbound email events delivered through Svix, a webhook-delivery service that signs each request with an HMAC signature so receivers can prove authenticity and integrity. The root cause is CWE-287 (Improper Authentication): the endpoint accepts and acts on the JSON body without verifying the Svix signature header, so any request that merely looks like a well-formed 'message.received' event is treated as genuine. This collapses the trust boundary between Svix and the agent runtime, letting untrusted input drive agent invocation.
RemediationAI
Upgrade to PraisonAI 4.6.78 or later, which restores Svix webhook signature verification (vendor-released patch: 4.6.78, per GHSA-7c92-x8vg-4258 and commits 846568c and 2a855c4). If immediate upgrade is not possible, restrict who can reach the AgentMail webhook endpoint by placing it behind network ACLs, a reverse proxy, or an API gateway that enforces the Svix signature (validate the svix-id, svix-timestamp, and svix-signature headers against the configured signing secret and reject unsigned or mismatched requests); the trade-off is added proxy configuration and holding the signing secret at the proxy. Where the AgentMail webhook integration is not required, disable webhook mode entirely to remove the attack surface, at the cost of losing inbound-email-triggered agent workflows. Consult the vendor advisory at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-7c92-x8vg-4258 for authoritative fix details.
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an att
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can inf
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to ex
Remote unauthenticated access to PraisonAI's legacy Flask API server allows attackers to execute configured agent workfl
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the appl
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today