CVE-2026-47255
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Multiple weaknesses in AgenticMail before versions 0.9.32 (API) and 0.9.10 (core), related to validation, binding, inactive-agent hour filtering, SQL identifier validation, metadata ownership checks, blocking direct metadata access via raw SQL, outbound worker secret handling, SMTP control character validation, and TLS certificate verification.
Risk Assessment
Potential unauthorized access, privilege escalation, data leakage, or man-in-the-middle attacks.
Recommendation
Update @agenticmail/api to version 0.9.32 or later and @agenticmail/core to version 0.9.10 or later.
Other vulnerabilities in AgenticMail
See all- CVE-2026-57495High
Vulnerability in AgenticMail packages (@agenticmail/claudecode before 0.2.39, @agenticmail/codex before 0.1.33, @agenticmail/core before 0.9.43, @agenticmail/openclaw before 0.5.71). An external email sent to the bridge inbox causes the operator's Claude Code session to resume with bypassed permissions, enabling indirect prompt injection into a fully-privileged agent.
- CVE-2026-57494High
Vulnerability in AgenticMail (versions before 0.9.64) allows a low-privileged authenticated agent to enumerate and claim tasks assigned to other agents. Missing authorization in task endpoints.
Original NVD description (English source)
AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related to validation and and binding of inactive-agent hour filtering; storage SQL identifier validation; metadata-backed ownership checks for raw storage SQL; blocking direct storage metadata access through raw SQL; fail-closed outbound worker secret handling; SMTP envelope/header control-character validation before command construction; and TLS certificate verification as the default for MailSender with an explicit opt-out for local development. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 are patched.