Tools AI Risk Radar ai-incident-0150
Incident record
PraisonAI fixes forged messages reaching AgentMail agents
- Severity
- High
- Status
- Patched
- Type
- Infra Vuln
- Target
- praisonai
- Actor
- researcher
- CVE
- CVE-2026-61436; CVE-2026-61428
What happened
The AgentMail connector’s webhook mode accepted unsigned messages from network callers. An attacker could impersonate a sender and have the configured agent process the forged content and reply to a chosen address.
praisonai: affected <= 4.6.77; fixed in 4.6.78. The date shown is the maintainer’s original disclosure date. Its advisory assigns 8.6 under CVSS 3.1. The two related AgentMail advisories are grouped in this record.
Sources
- Primary disclosuregithub.com/MervinPraison/PraisonAI/security/advisories/GHSA-…
- Supporting advisorygithub.com/MervinPraison/PraisonAI/security/advisories/GHSA-…
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026