AIDEFEND in Action AIA-0112 Validated Research Published: Oct 26, 2026

PraisonAI AgentMail: An Unsigned Webhook Starts an Agent Run

PraisonAI connects AI agents to messaging services. Its affected AgentMail webhook handler accepted an unsigned network request as an incoming email, trusted the supplied sender, and dispatched the text into an agent session. A local runtime test reached a canary agent through the real handler; it did not send real email or demonstrate a dangerous tool executing. The vulnerability is tracked as CVE-2026-61428 and fixed in 4.6.78.

Authentication BypassTool AuthorizationAgentic AI
2 applicable AIDEFEND defenses
Source: PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing 
Author: @MervinPraison
Original article: Jun 25, 2026

Threat Analysis

  • Trust changes at the receiver: a network peer supplies an email-shaped JSON body; the handler accepts its event type, builds a message and passes its sender and text to the agent. A sender allowlist cannot authenticate a sender value taken from that same unverified body.
  • Separate the demonstrated result from later risk: the real local handler reached a canary agent. The disclosed reproduction did not send live mail, and code execution requires additional dangerous tools and successful steering that this test does not establish.
  • Protect run admission: verify provider-native signatures before JSON transformation, preserve replay and actor/resource checks, and bind accepted events to a predetermined workflow. Authentication of delivery alone does not grant the sender the bot maker's authority.

Applicable AIDEFEND Defenses (2)

AID-H-003.010
Deployed AI Software Vulnerability Remediation Lifecycle
Very High
Inventory the deployed PraisonAI packages, replace versions through 4.6.77 with 4.6.78 or a later supported fixed build, and verify the running receiver. Before reopening webhook traffic, send missing-signature, invalid-signature and valid signed fixtures to the actual endpoint and confirm rejected requests never invoke the agent. Disable webhook/hybrid delivery until remediation is verified; polling and WebSocket are separate paths, not evidence of a webhook fix.
AID-H-004.007
External Event-to-Agent Admission & Authority Binding
Very High
At a tenant-controlled receiver or pre-run gateway, verify AgentMail/Svix signatures over the exact raw body using the endpoint secret, freshness and durable replay checks, before parsing and scheduling. Then authorize the verified inbox, actor and resource for a fixed limited workflow. Port the provider-specific adapter: the published Slack HMAC example is not an AgentMail implementation. A signed delivery or an unverified from field does not authorize internal search, privileged tools, or an arbitrary reply destination. Deny direct access that bypasses this receiver.

What Defenders Should Do Now

  • Update affected deployments and test the actual receiver with valid, missing and invalid signatures. Until verified, disable the affected delivery mode or put it behind a receiver the attacker cannot bypass.
  • Use the provider's signing SDK and endpoint-specific secret; keep raw-body verification before parsing. Test retries, replay, wrong inboxes and secret rotation without production mail or credentials.
  • Run legitimate incoming mail through a limited triage workflow. Require separate authorization for private reads, tool actions and the actual reply recipient.

Conclusion

The decisive control is before the email-shaped event becomes an agent run. AIDEFEND  maps this boundary to verified software remediation and provider-specific event admission, so an unauthenticated body cannot inherit the workflow owner's privileges.

Last updated: