CVE Dashboard
Back to Dashboard

CVE-2026-61428

Published: July 11, 2026•Last Modified: July 11, 2026
CVSS SCORE
7.3
HIGH

Vulnerability Description

PraisonAI AgentMail versions before 4.6.78 lack signature verification in webhook mode, allowing unauthenticated attackers to inject messages with spoofed sender addresses. Attackers can POST crafted message.received events to the webhook endpoint to inject arbitrary content into the agent and trigger replies to attacker-controlled addresses, bypassing sender allow/block lists.

Affected Products & Versions

No configurations parsed from local entry.

Security Advisories & References

Mitigation & Remediation

Update the affected packages to a secure version. Refer to vendor security advisories.

Share Advisory

Copy the standardized markdown formatted vulnerability report to post in Slack, Teams, email, or ticketing systems.

# HIGH - CVE-2026-61428 ## EFFECT PraisonAI AgentMail versions before 4.6.78 lack signature verification in webhook mode, allowing unauthenticated attackers to inject messages with spoofed sender addresses. Attackers can POST crafted message.received events to the webhook endpoint to inject arbitrary content into the agent and trigger replies to attacker-controlled addresses, bypassing sender allow/block lists. ## AFFECTED Unknown products ## LINKS - [github.com](https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qj9c-59p6-8cgx) - [www.vulncheck.com](https://www.vulncheck.com/advisories/praisonai-agentmail-before-message-injection-via-webhook) ## SOLUTION - Update the affected packages to a secure version. Refer to vendor security advisories.