Vulnerability · Published Jul 15, 2026 · Assigned by VulnCheck
CVE-2026-61436PraisonAI before 4.6.78 Missing Webhook Signature Verification
High 8.6
In plain English
A high-severity improper authentication in PraisonAI from MervinPraison. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.6High
Exploit odds (30 days)0.4%top 66.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke configured agents with arbitrary sender addresses and message content.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | praisonai | 4.6.78 | GHSA-7c92-x8vg-4258 |
| PyPI | praisonai | 4.6.78 | PYSEC-2026-4252 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MervinPraison | PraisonAI | 0 – before 4.6.78 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
References
- GitHub Security Advisory (GHSA-7c92-x8vg-4258) vendor-advisory
- https://github.com/MervinPraison/PraisonAI/commit/846568c7a5d8ce9e71e56e4c213f027c04909753 patch
- https://github.com/MervinPraison/PraisonAI/commit/2a855c470077c7d2e2479a575f7ef7f548d51c33 patch
- VulnCheck Advisory: PraisonAI before 4.6.78 Missing Webhook Signature Verification third-party-advisory