{"id":"CVE-2026-57122","title":"PraisonAI is a multi-agent teams system","summary":"PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPP_APP_SECRET or LINEAR_WEBHOOK_SECRET is configured and otherwise parse and dispatch unsigned …","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","cwe":["CWE-345","CWE-347"],"vendor":"MervinPraison","product":"PraisonAI","affected":["PraisonAI < 4.6.59"],"patched":["praisonai 4.6.59"],"published":"2026-09-14","updated":"2026-09-15","sourceUpdated":"2026-09-15T14:45:28.563","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57122","references":[{"url":"https://github.com/MervinPraison/PraisonAI/commit/2adfe7e8323f6deec66925cf15a885b6238895e9","label":"security-advisories@github.com"},{"url":"https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.59","label":"security-advisories@github.com"},{"url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-x92v-rpx6-p6cw","label":"security-advisories@github.com"},{"url":"https://github.com/MervinPraison/PraisonAI"}],"tags":["nvd","cve.org","osv","pip"],"epss":0.00188,"epssPercentile":0.07387,"aliases":["GHSA-x92v-rpx6-p6cw"],"ecosystem":"pip","ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-14T17:06:07.666555Z"},"ingestedAt":"2026-07-21T19:04:57.895Z","slug":"CVE-2026-57122","body":"## Overview\n\nPraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPP_APP_SECRET or LINEAR_WEBHOOK_SECRET is configured and otherwise parse and dispatch unsigned request bodies. A remote unauthenticated client that reaches the webhook route can forge messages, comments, or agent-session events, impersonate platform users, influence agent prompts and actions, and disrupt bot processing. This issue is fixed in 4.6.59.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-57122)\n\nAffected packages:\n\n- `praisonai < 4.6.59`\n\nPatched in:\n\n- `praisonai 4.6.59`\n\nSource: https://osv.dev/vulnerability/GHSA-x92v-rpx6-p6cw","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}