CVE-2026-56837

PraisonAI's LinearBot starts a public webhook listener on "0.0.0.0" and treats "LINEARWEBHOOKSECRET" as optional. When the secret is absent, startup only logs a warning and "handlewebhook" skips "Linear-Signature" verification entirely. An unauthenticated network caller who can reach the webhook...