CVE-2026-61428

Name of the Vulnerable Software and Affected Versions PraisonAI AgentMail versions prior to 4.6.78

Description The software lacks signature verification when operating in webhook mode. This allows unauthenticated attackers to inject messages with spoofed sender addresses by sending crafted message.received events to the webhook endpoint. This action enables the injection of arbitrary content into the agent and can trigger replies to addresses controlled by the attacker, effectively bypassing sender allow and block lists.

Recommendations Update to version 4.6.78 or later.