Am I affected by PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing? What should I do?

Question

PraisonAI's LinearBot starts a public webhook listener on `0.0.0.0` and treats `LINEAR_WEBHOOK_SECRET` as optional.

Affected: praisonai 4.6.56 to 4.6.58. Fixed in: 4.6.59. What should you check, and what should you do about it?

Full incident page with sources: https://agentarmorhq.com/incidents/2026/06/cve-2026-56837-praisonai

AgentArmorHQ team · Accepted Answer

**Am I affected?**
Affected: praisonai 4.6.56 to 4.6.58. Fixed in: 4.6.59.
- Check your version: run `pip show praisonai`. Versions >= 4.6.56, <= 4.6.58 of praisonai are affected.

**What to do now**
1. Upgrade to the fixed version: run `pip install --upgrade "praisonai>=4.6.59"` (first patched version 4.6.59).
2. Set `LINEAR_WEBHOOK_SECRET`.
3. Pass `LINEAR_WEBHOOK_SECRET` to `praisonai bot linear`.

General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

**Sources**
- GitHub Advisory Database: https://github.com/advisories/GHSA-fc26-m9pf-v56q

Full incident page: https://agentarmorhq.com/incidents/2026/06/cve-2026-56837-praisonai

Am I affected by PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing? What should I do?

1 answer

Add your answer or comment