AgenticMail CVE-2026-57494
HIGH
GHSA-hjwc-26pj-v3pm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires a valid low-privilege agent token (PR:L) over the network with no interaction; reads victim task payloads (C:H) and can submit or alter task results (I:H), raising integrity above the vendor's VI:N.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3Blast Radius
ecosystem impact- 1 npm packages depend on @agenticmail/api (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.9.64.
DescriptionCVE.org
AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supplying the target agent name to GET /api/agenticmail/tasks/pending?assignee=<name>. The returned task objects include the task IDs and payloads. The same task IDs can then be used with the capability-style task mutation endpoints (/tasks/:id/claim, /tasks/:id/result, /tasks/:id/complete, /tasks/:id/fail) to claim, complete, or fail tasks assigned to a different agent. Because ordinary authenticated agents can discover agent names through GET /api/agenticmail/accounts/directory, the task ID effectively stops being a secret capability. This turns the intended capability model into a cross-agent authorization bypass. Version 0.9.64 contains a fix.
AnalysisAI
Cross-agent authorization bypass in AgenticMail's @agenticmail/api (prior to 0.9.64) lets any low-privileged authenticated agent read and hijack tasks belonging to other agents. By calling GET /api/agenticmail/tasks/pending?assignee=<victim>, an attacker enumerates a target agent's pending/claimed tasks - including task IDs and sensitive payloads - then reuses those IDs against the /tasks/:id/claim, /result, /complete, and /fail endpoints, which never verify the caller is the assignee. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid, low-privileged AgenticMail agent API key (bearer token) - PR:L, so this is authenticated, not anonymous. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H, base 7.1) is internally consistent for a network-reachable, low-privilege, no-interaction IDOR, and PR:L correctly reflects that a valid agent API key is required - this is not unauthenticated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A malicious or compromised agent holding an ordinary AgenticMail API key calls /accounts/directory to learn a rival agent's name, then queries /tasks/pending?assignee=<victim> to read sensitive task payloads intended for that agent. Using the disclosed task IDs, it submits attacker-controlled results via /tasks/:id/result or marks the tasks complete/failed, corrupting the victim's workflow. … |
| Remediation | Vendor-released patch: upgrade @agenticmail/api to 0.9.64 or later, which contains the fix, per GHSA-hjwc-26pj-v3pm (https://github.com/agenticmail/agenticmail/security/advisories/GHSA-hjwc-26pj-v3pm). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all deployments of @agenticmail/api and verify current version numbers-if running prior to version 0.9.64, escalate for urgent patching. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today