Missing sender authentication in AgenticMail inbound mail bridge-wake handler (CVE-2026-57495)

In AgenticMail, the bridge-wake inbound mail handler resumes the operator's Claude Code session with `permissionMode: 'bypassPermissions'` without verifying that the sending address belongs to the operator. Any external email routed to the bridge inbox allows an unauthenticated attacker to embed attacker-controlled `from`, `subject`, and `preview` fields verbatim into the prompt of a fully-privileged agent running with Bash, Write, Edit, and WebFetch access under the operator's OAuth identity, constituting an indirect prompt injection attack. Affected versions: - @agenticmail/claudecode < 0.2.39 - @agenticmail/codex < 0.1.33 - @agenticmail/core < 0.9.43 - @agenticmail/openclaw < 0.5.71 We recommend updating to: @agenticmail/claudecode 0.2.39, @agenticmail/codex 0.1.33, @agenticmail/core 0.9.43, @agenticmail/openclaw 0.5.71. CVSS 8.2 · our assessment: this_week Reference: https://github.com/agenticmail/agenticmail/security/advisories/GHSA-fq4x-789w-jg5h Details: https://vuln.today/cve/CVE-2026-57495