CVE-2026-57494
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Vulnerability in AgenticMail (versions before 0.9.64) allows a low-privileged authenticated agent to enumerate and claim tasks assigned to other agents. Missing authorization in task endpoints.
Risk Assessment
Risk of task hijacking, leading to unauthorized data access and workflow disruption.
Recommendation
Upgrade AgenticMail to version 0.9.64.
Other vulnerabilities in AgenticMail
See all- CVE-2026-57495High
Vulnerability in AgenticMail packages (@agenticmail/claudecode before 0.2.39, @agenticmail/codex before 0.1.33, @agenticmail/core before 0.9.43, @agenticmail/openclaw before 0.5.71). An external email sent to the bridge inbox causes the operator's Claude Code session to resume with bypassed permissions, enabling indirect prompt injection into a fully-privileged agent.
- CVE-2026-47255High
Multiple weaknesses in AgenticMail before versions 0.9.32 (API) and 0.9.10 (core), related to validation, binding, inactive-agent hour filtering, SQL identifier validation, metadata ownership checks, blocking direct metadata access via raw SQL, outbound worker secret handling, SMTP control character validation, and TLS certificate verification.
Original NVD description (English source)
AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supplying the target agent name to `GET /api/agenticmail/tasks/pending?assignee=<name>`. The returned task objects include the task IDs and payloads. The same task IDs can then be used with the capability-style task mutation endpoints (`/tasks/:id/claim`, `/tasks/:id/result`, `/tasks/:id/complete`, `/tasks/:id/fail`) to claim, complete, or fail tasks assigned to a different agent. Because ordinary authenticated agents can discover agent names through `GET /api/agenticmail/accounts/directory`, the task ID effectively stops being a secret capability. This turns the intended capability model into a cross-agent authorization bypass. Version 0.9.64 contains a fix.