CVE-2026-57494
CVE-2026-57494 · AgenticMail: Cross-agent task authorization bypass in AgenticMail API
This page contains facts from public vulnerability sources. Check the original advisory before updating.
AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supplying the target agent name to `GET /api/agenticmail/tasks/pending?assignee=<name>`. The returned task objects include the task IDs and payloads. The same task IDs can then be used with the capability-style task mutation endpoints (`/tasks/:id/claim`, `/tasks/:id/result`, `/tasks/:id/complete`, `/tasks/:id/fail`) to claim, complete, or fail tasks assigned to a different agent. Because ordinary authenticated agents can discover agent names through `GET /api/agenticmail/accounts/directory`, the task ID effectively stops being a secret capability. This turns the intended capability model into a cross-agent authorization bypass. Version 0.9.64 contains a fix.
CVSS 7.1 · High · EPSS 0.3% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
@agenticmail/api
- Versions
- < 0.9.64: Affected
No fix published
@agenticmail/api npm
- Affected ranges
- SEMVER: < 0.9.64
Update to 0.9.64