{"items":[{"id":"NVI-00016151","kind":"vulnerability","title":"PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-fc26-m9pf-v56q","CVE-2026-56837"],"plain_summary":"GitHub lists this reviewed advisory for praisonai. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-31992842c61f8574480f3c555367a0a7"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-20T21:23:40.000Z","value":"8.6 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-31992842c61f8574480f3c555367a0a7"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-31992842c61f8574480f3c555367a0a7","url":"https://github.com/advisories/GHSA-fc26-m9pf-v56q","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-fc26-m9pf-v56q","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T02:47:44.783Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-31992842c61f8574480f3c555367a0a7"],"technology":"praisonai","known_exclusions":[],"conditions_summary":"# PraisonAI LinearBot processes unsigned webhooks when `LINEAR_WEBHOOK_SECRET` is missing\n\n## Summary\n\nPraisonAI's LinearBot starts a public webhook listener on `0.0.0.0` and treats\n`LINEAR_WEBHOOK_SECRET` as optional. When the secret is absent, startup only logs\na warning and `_handle_webhook()` skips `Linear-Signature` verification entirely.\n\nAn unauthenticated network caller who can reach the webhook endpoint can submit\na forged `Linear-Event: AgentSession` request. The forged request is parsed,\nscheduled for background processing, dispatched to `_handle_agent_session()`,\nand passed into `BotSessionManager.chat()`. The bot then attempts to post the\nagent response back to Linear under the configured bot token.\n\nThe local PoV is offline and deterministic. It does not contact Linear. It calls\nthe webhook handler directly, monkey-patches the outbound Linear comment path,\nand proves both sides of the boundary:\n\n- no secret configured: unsigned forged webhook returns `200`, invokes the\n  agent session path once, and attempts one Linear comment;\n- secret configured: missing and bad signatures both return `401` and do not\n  invoke the agent;\n- secret configured with valid HMAC: request ","public_affected_ranges":[">= 4.6.56, <= 4.6.58"]}],"null_published_at":"2026-11-04T10:04:27.899Z","source_updated_at":"2026-07-20T21:23:40.000Z","source_disclosed_at":"2026-06-18T13:52:55.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-04T02:47:44.783Z"}],"next_cursor":null,"snapshot_revision":"42594"}