CVE-2026-61436

8.6 HIGH
Published: July 15, 2026 Modified: July 15, 2026
View on NVD

Description

PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke configured agents with arbitrary sender addresses and message content.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://github.com/MervinPraison/PraisonAI/commit/2a855c470077c7d2e2479a575f7ef7f548d51c33
Source: disclosure@vulncheck.com
https://github.com/MervinPraison/PraisonAI/commit/846568c7a5d8ce9e71e56e4c213f027c04909753
Source: disclosure@vulncheck.com
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-7c92-x8vg-4258
Source: disclosure@vulncheck.com
https://www.vulncheck.com/advisories/praisonai-before-missing-webhook-signature-verification
Source: disclosure@vulncheck.com
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-7c92-x8vg-4258
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

5 reference(s) from NVD

Quick Stats

CVSS v3 Score
8.6 / 10.0
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-287

Related CVEs

CVE-2026-58559 6.5
CVE-2026-58558 7.8
CVE-2026-58557 4.8
CVE-2026-58556 5.1
CVE-2026-58555 6.6