PraisonAI email bot accepts forged webhooks, advisories say

Two security advisories published on 7 October 2026 say that PraisonAI's AgentMail bot, when run in webhook or hybrid mode, accepts inbound email events without checking that they came from the email provider. The flaws are tracked as CVE-2026-61428 and CVE-2026-61436 and affect the praisonai Python package, with version 4.6.63 named as the affected version in the first advisory. Severity is described as medium.

According to the advisories, the bot starts an aiohttp web server bound to 0.0.0.0 — that is, listening on every network interface — on a default port of 8080 with a default path of /webhook. When a POST request arrives, the handler reads the JSON body, checks whether the type field is message.received, and then passes the payload straight into the agent pipeline. No signature is verified, no authentication is required, and the raw request body is never inspected.

The second advisory explains why that matters. AgentMail delivers webhooks through Svix and includes svix-id, svix-timestamp and svix-signature headers, which receivers are expected to verify against an endpoint signing secret before trusting the event. PraisonAI does register a webhook with the provider when a webhook URL is configured, the advisory says, but it does not store or use the secret that is returned.

Because the sender address and message body are taken directly from the request, an attacker can set the from field to any address. That bypasses the bot's sender allow and block lists, the first advisory says, and means any reply the agent generates is sent to an address the attacker chose. The advisories list unauthenticated message injection, access-control bypass, exfiltration of agent replies to an attacker-chosen address, a prompt-injection surface and large language model cost abuse among the impacts. If the agent has access to dangerous tools, the first advisory adds, prompt injection could be escalated further.

Both advisories point out that sibling code in the same project behaves differently. The Linear and WhatsApp bot handlers call a verification gate and reject requests when no secret is configured — they fail closed. The AgentMail handler omits the check entirely, so it fails open.

The reports include runtime proof. In one, researchers mounted the real handler locally and sent a crafted message.received event with a sender of attacker@evil.example and a marker string in the body. The server returned 200 OK and a logging endpoint confirmed the forged message reached the agent. In the other, the handler was called directly with fake request objects. A forged unsigned event and a forged event carrying a deliberately invalid Svix signature both returned status 200 and triggered one agent call and one reply attempt. Control cases behaved as expected: malformed JSON returned 400, and non-message events and duplicate messages did not reach the agent.

The second advisory says it tested both the project's then-current head commit and release tag v4.6.62, and found both vulnerable. It also says the report is scoped to webhook mode only, and makes no claim about the default polling path or the WebSocket path, which receives typed events through the provider's SDK connection. Neither advisory lists a fixed version. The status of the reports is recorded as reported.