PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.6.58"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.6.56"
            },
            {
              "fixed": "4.6.59"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-306",
      "CWE-347"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-18T13:52:55Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "# PraisonAI LinearBot processes unsigned webhooks when `LINEAR_WEBHOOK_SECRET` is missing\n\n## Summary\n\nPraisonAI\u0027s LinearBot starts a public webhook listener on `0.0.0.0` and treats\n`LINEAR_WEBHOOK_SECRET` as optional. When the secret is absent, startup only logs\na warning and `_handle_webhook()` skips `Linear-Signature` verification entirely.\n\nAn unauthenticated network caller who can reach the webhook endpoint can submit\na forged `Linear-Event: AgentSession` request. The forged request is parsed,\nscheduled for background processing, dispatched to `_handle_agent_session()`,\nand passed into `BotSessionManager.chat()`. The bot then attempts to post the\nagent response back to Linear under the configured bot token.\n\nThe local PoV is offline and deterministic. It does not contact Linear. It calls\nthe webhook handler directly, monkey-patches the outbound Linear comment path,\nand proves both sides of the boundary:\n\n- no secret configured: unsigned forged webhook returns `200`, invokes the\n  agent session path once, and attempts one Linear comment;\n- secret configured: missing and bad signatures both return `401` and do not\n  invoke the agent;\n- secret configured with valid HMAC: request returns `200` and invokes the\n  agent, proving the control path still works.\n\n## Affected Product\n\n- Repository: `MervinPraison/PraisonAI`\n- Package: `praisonai`\n- Components:\n  - `src/praisonai/praisonai/bots/linear.py`\n  - `src/praisonai/praisonai/cli/features/bots_cli.py`\n\nValidated affected:\n\n- live `main` / latest observed release `v4.6.58`:\n  `1ad58ca02975ff1398efeda694ea2ab78f20cf3e`\n- previous local current checkout:\n  `2f9677abb2ea68eab864ee8b6a828fd0141612e1`\n- `v4.6.57`\n- `v4.6.56`\n- `v4.5.50`\n\nSampled tags where the LinearBot component was not present:\n\n- `v4.5.49`\n- `v4.5.51`\n- `v4.6.9`\n- `v4.6.10`\n\nSuggested affected range: LinearBot-bearing releases with the fail-open\nsignature behavior, at least `4.5.50` and `\u003e= 4.6.56, \u003c= 4.6.58`. The\ncomponent appears non-contiguously in sampled tags, so maintainers should\nconfirm the exact packaged version history before publishing a final range.\n\n## Root Cause\n\n`LinearBot.__init__()` accepts an empty signing secret and falls back to an\nempty environment value:\n\n```python\nself._signing_secret = signing_secret or os.environ.get(\"LINEAR_WEBHOOK_SECRET\", \"\")\n```\n\n`start()` treats the missing secret as a warning instead of refusing to expose\nthe webhook listener:\n\n```python\nif not self._signing_secret:\n    logger.warning(\"LINEAR_WEBHOOK_SECRET not set - webhook signatures will not be verified\")\n\nself._site = web.TCPSite(self._runner, \"0.0.0.0\", self._webhook_port)\n```\n\n`_handle_webhook()` only verifies the request if the secret is truthy:\n\n```python\nif self._signing_secret:\n    signature = request.headers.get(\"Linear-Signature\", \"\")\n    if not self._verify_signature(raw_body, signature):\n        return web.Response(status=401, text=\"Invalid signature\")\n```\n\nWith no secret configured, the code continues to JSON parsing, accepts a caller\nsupplied `webhookTimestamp`, reads the caller supplied `Linear-Event` header,\nand schedules processing:\n\n```python\nevent_type = request.headers.get(\"Linear-Event\", \"\")\ntask = asyncio.create_task(self._process_webhook(event_type, body))\nreturn web.Response(status=200, text=\"OK\")\n```\n\nFor `AgentSession`, the forged body is routed to the agent:\n\n```python\nif event_type == \"AgentSession\":\n    await self._handle_agent_session(body)\n...\nresponse = await self._session_mgr.chat(self._agent, user_id, message.content)\nawait self._send_comment(...)\n```\n\nThe CLI has the same fail-open posture: `start_linear()` loads\n`LINEAR_WEBHOOK_SECRET`, prints a warning when it is missing, then reports a\npublic `http://0.0.0.0:\u003cport\u003e/webhook` endpoint with verification disabled.\n\n## Why This Is Not Intended Behavior\n\nPraisonAI\u0027s Linear Bot documentation tells operators to set\n`LINEAR_WEBHOOK_SECRET`, pass it to `praisonai bot linear`, copy the Linear\nwebhook signing secret, and use it for HMAC-SHA256 verification. The same page\nsays missing secrets disable signature verification, while its best-practices\nsection says webhook secrets ensure authenticity.\n\nLinear\u0027s webhook documentation says receivers should ensure requests were sent\nby Linear by verifying the `Linear-Signature` HMAC over the raw body, then\nchecking that `webhookTimestamp` is recent. The timestamp check alone is not an\nauthentication boundary because an attacker can supply a current timestamp in a\nforged body.\n\nThe implementation itself also confirms the intended boundary: when a secret is\nconfigured, missing and bad signatures are rejected before agent dispatch. The\nbug is the missing-secret fail-open mode on a public webhook server, not the\nsignature algorithm.\n\n## Local PoV\n\nRun against the latest observed release checkout:\n\n```bash\npython3 submission-bundle/praisonai-prai-cand-013-linear-webhook-signature-fail-open/poc/pov_prai_cand_013_linear_webhook_signature_fail_open.py --repo artifacts/repos/praisonai-v4.6.58\n```\n\nExpected output includes:\n\n```json\n{\n  \"candidate\": \"PRAI-CAND-013\",\n  \"ok\": true,\n  \"cases\": {\n    \"no_secret_unsigned_forged_webhook\": {\n      \"http_status\": 200,\n      \"signing_secret_configured\": false,\n      \"session_calls\": [\n        {\n          \"user_id\": \"linear-system\",\n          \"content\": \"Issue: Forged Linear AgentSession event\\n\\nPRAI-CAND-013 local forged webhook payload\"\n        }\n      ],\n      \"sent_comments\": [\n        {\n          \"issue_id\": \"issue-prai-cand-013\",\n          \"comment\": \"agent response\",\n          \"session_id\": \"prai-cand-013-session\"\n        }\n      ]\n    },\n    \"secret_missing_signature_control\": {\n      \"http_status\": 401,\n      \"session_calls\": []\n    },\n    \"secret_bad_signature_control\": {\n      \"http_status\": 401,\n      \"session_calls\": []\n    },\n    \"secret_valid_signature_control\": {\n      \"http_status\": 200,\n      \"session_calls\": [\n        {\n          \"user_id\": \"linear-system\"\n        }\n      ]\n    }\n  }\n}\n```\n\nStored evidence:\n\n- `evidence/pov-v4.6.58.json`\n- `evidence/pov-live-main-v4.6.58.json`\n- `evidence/pov-current-head.json`\n- `evidence/version-sweep.tsv`\n\n## Impact\n\nIf a PraisonAI operator starts LinearBot with a Linear token but omits\n`LINEAR_WEBHOOK_SECRET`, any network caller that can reach the webhook endpoint\ncan spoof Linear webhook events and invoke the configured agent through the\nLinear integration.\n\nFor the `AgentSession` event path, this lets the attacker supply issue title and\ndescription content that becomes the agent input. Depending on the configured\nagent and tools, this can cause unauthorized LLM/tool execution, consume paid\nmodel quota, create or update Linear comments under the bot identity, and drive\nthe bot into workflows intended only for authenticated Linear events.\n\nThis report does not claim arbitrary code execution by default. The concrete\nboundary crossed is unauthenticated remote agent invocation through a forged\nLinear webhook.\n\n## Suggested Fix\n\nFail closed for public webhook listeners:\n\n1. Refuse to start LinearBot when `LINEAR_WEBHOOK_SECRET` is missing, unless an\n   explicit development-only option such as\n   `--insecure-skip-webhook-signature-verification` is provided.\n2. In `_handle_webhook()`, reject requests when no signing secret is configured\n   instead of silently skipping verification.\n3. Preserve raw-body HMAC verification and constant-time comparison for the\n   configured-secret path.\n4. Treat timestamp freshness as replay protection after signature validation,\n   not as a replacement for authentication.\n5. Prefer loopback binding by default, or require an explicit host flag for\n   public binding.\n6. Add regression tests:\n   - no signing secret rejects startup or rejects webhook requests;\n   - missing signature with a configured secret returns `401`;\n   - invalid signature with a configured secret returns `401`;\n   - valid HMAC with a configured secret returns success;\n   - stale timestamp after valid HMAC returns `401`;\n   - the CLI does not advertise a public unauthenticated webhook by default.",
  "id": "GHSA-fc26-m9pf-v56q",
  "modified": "2026-06-18T13:52:55Z",
  "published": "2026-06-18T13:52:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-fc26-m9pf-v56q"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing"
}