Which versions of AgenticMail are affected by CVE-2026-57495?

AgenticMail's inbound-mail bridge exposes critical session hijacking risk through unauthenticated prompt injection flaws in four npm packages across multiple versions.. A patch is available.

AgenticMail CVE-2026-57495

Q: What is the CVSS score of CVE-2026-57495?

CVE-2026-57495 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

Q: How to fix or mitigate CVE-2026-57495?

Within 24 hours, inventory all affected @agenticmail packages across development environments and disable the inbound-mail bridge entirely as an interim measure; audit CloudCode session logs and operator OAuth activity for signs of compromise or anomalous access. Within 7 days, identify exact package versions in use (@agenticmail/core < 0.9.43, @agenticmail/claudecode < 0.2.39, @agenticmail/codex < 0.1.33, @agenticmail/openclaw < 0.5.71), subscribe to GHSA-fq4x-789w-jg5h for patch notifications, and enforce SPF/DKIM/DMARC email authentication plus sender allowlisting if the bridge must remain active. Within 30 days, deploy patched versions once released and validate security fixes before re-enabling the bridge in production.

HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-20 security-advisories@github.com

GHSA-fq4x-789w-jg5h

Authentication Bypass

8.2

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.0 CRITICAL

Unauthenticated external email (PR:N/UI:N) injects into a bypassPermissions agent, crossing from the mail bridge to the host (S:C) with full Bash/file impact (C/I/A:H); AC:H because injection success and a resumable session are required.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 20, 2026 - 22:32 vuln.today

Analysis Generated

Jul 20, 2026 - 22:32 vuln.today

CVE Published

Jul 20, 2026 - 22:17 cve.org

HIGH 8.2

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 npm packages depend on @agenticmail/claudecode (2 direct, 0 indirect)
1 npm packages depend on @agenticmail/codex (1 direct, 0 indirect)
6 npm packages depend on @agenticmail/core (6 direct, 1 indirect)

Ecosystem-wide dependent count for version 0.2.39 and other introduced versions.

DescriptionCVE.org

AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/claudecode prior to version 0.2.39, @agenticmail/codex prior to version 0.1.33, @agenticmail/core prior to version 0.9.43, and @agenticmail/openclaw prior to version 0.5.71, two inbound-mail handlers act on a privileged effect without verifying that the sender is the operator, while a sibling handler in the same repo does. The higher-impact one: any external email routed to the bridge inbox causes the dispatcher to resume the operator's Claude Code session with permissionMode: 'bypassPermissions', embedding the attacker-controlled from/subject/preview verbatim into the prompt the resumed agent reads - an indirect prompt injection into a fully-privileged agent (Bash/Write/Edit/WebFetch + the agenticmail MCP toolbelt) running as the operator's OAuth identity. The sibling operator-query email-reply hook gates the same untrusted-From provenance with isOperatorReplySender(replyFrom, config.operatorEmail) (fail-closed); the bridge-wake path - a strictly higher-privilege effect - has no equivalent. @agenticmail/claudecode 0.2.39, @agenticmail/codex 0.1.33, @agenticmail/core 0.9.43, and @agenticmail/openclaw 0.5.71 contain a fix.

AnalysisAI

Indirect prompt injection in AgenticMail's inbound-mail bridge lets any external, unauthenticated email hijack the operator's Claude Code session, which resumes with permissionMode 'bypassPermissions' and full tooling (Bash/Write/Edit/WebFetch plus the agenticmail MCP toolbelt) under the operator's OAuth identity. Affected are @agenticmail/core < 0.9.43, @agenticmail/claudecode < 0.2.39, @agenticmail/codex < 0.1.33, and @agenticmail/openclaw < 0.5.71, where the bridge-wake handler embeds attacker-controlled from/subject/preview verbatim into the agent prompt with no sender verification - despite a sibling handler correctly gating on isOperatorReplySender. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the GitHub Security Advisory (GHSA-fq4x-789w-jg5h) documents the exact vulnerable code paths, and EPSS was not supplied.

Technical ContextAI

AgenticMail is a Node/npm toolchain (packages @agenticmail/core, claudecode, codex, openclaw) that provisions real email addresses and phone numbers for AI agents and bridges inbound messages into a resumable Claude Code agent session. External mail enters at packages/api/src/routes/inbound.ts (POST /mail/inbound); the x-inbound-secret header only authenticates the relay-to-API hop, so the sender-controlled from/subject/preview fields are untrusted. The root cause is CWE-306 (Missing Authentication for a Critical Function): handleBridgeMail (dispatcher.ts:2040) calls planBridgeWake with no operator-sender check, composeBridgeWakePrompt (core/src/host-bridge.ts:141) splices the untrusted fields into the prompt, and resumeBridgeSession (bridge-wake.ts:103) executes that prompt through the Claude Code SDK with permissionMode 'bypassPermissions'. This is a textbook indirect prompt-injection sink: untrusted text flows straight into a fully-privileged LLM agent that can run shell commands and file edits as the operator.

Affected ProductsAI

The vulnerability affects the AgenticMail npm packages: @agenticmail/core prior to 0.9.43, @agenticmail/claudecode prior to 0.2.39, @agenticmail/codex prior to 0.1.33, and @agenticmail/openclaw prior to 0.5.71, with the untrusted-provenance and privileged-sink code present at current HEAD commit b95f52e. No CPE strings were provided (these are npm coordinates rather than NVD CPEs). The authoritative reference is the GitHub Security Advisory GHSA-fq4x-789w-jg5h at https://github.com/agenticmail/agenticmail/security/advisories/GHSA-fq4x-789w-jg5h.

RemediationAI

Vendor-released patches are available: upgrade to @agenticmail/core 0.9.43, @agenticmail/claudecode 0.2.39, @agenticmail/codex 0.1.33, and @agenticmail/openclaw 0.5.71 (or later), which add the missing operator-sender verification to the bridge-wake path; because the packages interoperate, upgrade them together to avoid version-skew gaps. Until patched, the most effective compensating control is to disable the bridge-wake / auto-resume path or the bridge inbox so external mail cannot trigger a session resume - this stops the attack but removes the automated inbound-to-agent workflow. As additional controls, restrict who can deliver to the bridge inbox (only allow the configured operatorEmail, mirroring the fail-closed isOperatorReplySender check used by the sibling operator-query hook), and avoid running the agent session with bypassPermissions, at the cost of requiring interactive approval for tool calls. See the advisory at https://github.com/agenticmail/agenticmail/security/advisories/GHSA-fq4x-789w-jg5h for details.