CVE-2026-47255: AgenticMail SQL Injection Vulnerability

CVE-2026-47255 Overview

CVE-2026-47255 affects AgenticMail, a platform that provisions real email addresses and phone numbers for AI agents. The vulnerability spans multiple components in @agenticmail/api before version 0.9.32 and @agenticmail/core before version 0.9.10. Weaknesses include unvalidated inactive-agent hour filtering, raw SQL identifier validation gaps, missing ownership checks on storage metadata, insecure outbound worker secret handling, missing SMTP envelope and header control-character validation, and TLS certificate verification not being enforced by default in MailSender. The root weakness class is Improper Input Validation [CWE-20]. Network-based attackers can abuse these gaps to inject SQL, bypass ownership checks, and smuggle SMTP commands.

Critical Impact
Unauthenticated network attackers can inject SQL into storage routes, bypass agent-scoped ownership checks on stored metadata, smuggle SMTP commands via unvalidated envelope and header input, and downgrade outbound mail TLS due to unverified certificates.

Affected Products

@agenticmail/api prior to version 0.9.32
@agenticmail/core prior to version 0.9.10
AgenticMail deployments using MailSender without explicit TLS verification settings

Discovery Timeline

2026-07-20 - CVE-2026-47255 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47255

Vulnerability Analysis

CVE-2026-47255 bundles several input validation and access control defects across the AgenticMail API and core packages. The storage router interpolated identifiers and clauses such as HAVING directly into SQL after only partial validation. A comma-joined FROM list like FROM agt_mine, agt_victim was scanned for only the first table, so ownership checks by verifySqlAccess were skipped for the second reference. The HAVING clause was never sanitized at all, permitting stacked statements and comment markers. Account routes accepted arbitrary values for inactive-agent hour filtering without positive integer validation. The mail sender omitted control-character validation on SMTP envelope addresses and headers, allowing CRLF injection into SMTP commands. MailSender also shipped without rejectUnauthorized enabled by default, so remote SMTP connections did not verify TLS certificates. An outbound worker secret was stored as plain_text in worker metadata rather than a secret binding.

Root Cause

The root cause is inconsistent input validation and identifier binding across trust boundaries [CWE-20]. Storage SQL construction relied on incomplete regex-based reference extraction, ownership enforcement was decoupled from all SQL clauses, and outbound mail defaults favored developer convenience over transport security.

Attack Vector

A remote attacker with network access to the AgenticMail API can craft storage requests that reference secondary tables in a comma join, evade verifySqlAccess, and read or mutate other agents' storage rows. The same attacker can submit malicious HAVING clauses or CRLF-laden SMTP envelope fields to smuggle SMTP commands. Passive network attackers on the outbound mail path can intercept mail because TLS certificates are not verified by default.

typescript

// Patch: harden storage ref extraction and HAVING clause validation
const refs = new Set<string>();
const refPattern = /\b(?:FROM|INTO|UPDATE|TABLE|JOIN)\s+["`\[]?([A-Za-z_][A-Za-z0-9_]{0,63})["`\]]?/gi;
for (const match of sql.matchAll(refPattern)) refs.add(match[1]);
// Hardening — catch storage-table-shaped tokens missed by comma-joins
const storageTokenPattern = /\b(agt_[A-Za-z0-9_]+|shared_[A-Za-z0-9_]+|agenticmail_storage_meta)\b/gi;
for (const match of sql.matchAll(storageTokenPattern)) refs.add(match[1]);
return [...refs];

function sanitizeHavingClause(having: string): string {
  if (typeof having !== 'string') {
    throw new StorageRouteError('having must be a string');
  }
  if (having.length > 200) {
    throw new StorageRouteError('having clause is too long (max 200 chars)');
  }
}

Source: GitHub Commit 1408de5

Detection Methods for CVE-2026-47255

Indicators of Compromise

Storage API requests containing comma-joined table references such as FROM agt_*, agt_* or references to agenticmail_storage_meta from unexpected agent contexts.
HAVING clause payloads exceeding 200 characters or containing ;, --, /*, or DDL and DML keywords.
Inactive-agent hour query parameters with non-integer or negative values.
Outbound SMTP sessions from AgenticMail hosts negotiating TLS without certificate validation to non-loopback destinations.

Detection Strategies

Review AgenticMail API access logs for storage route calls whose SQL body deviates from the parameterized templates emitted by the patched client.
Alert on any OUTBOUND_SECRET value present in worker metadata files after upgrade, indicating an unpatched deployment.
Inspect SMTP proxy logs for envelope fields or header values containing \r, \n, or unexpected RCPT TO and MAIL FROM command fragments.

Monitoring Recommendations

Track deployed versions of @agenticmail/api and @agenticmail/core in software inventory and flag any instance below 0.9.32 or 0.9.10 respectively.
Monitor for anomalous cross-agent storage reads that touch tables not owned by the calling agent identity.
Capture and retain outbound SMTP TLS handshakes for post-hoc verification of certificate chains.

How to Mitigate CVE-2026-47255

Immediate Actions Required

Upgrade @agenticmail/api to version 0.9.32 or later and @agenticmail/core to version 0.9.10 or later.
Rotate any OUTBOUND_SECRET values previously stored as plain_text bindings in worker metadata.
Audit storage tables for unauthorized cross-agent reads or writes since deployment.
Confirm remote SMTP relays present valid certificates and re-enable rejectUnauthorized explicitly if it was overridden.

Patch Information

Patches are available in @agenticmail/api0.9.32 and @agenticmail/core0.9.10. Fixes are tracked in GitHub Security Advisory GHSA-wjjv-3mj2-39hf and merged across commits 1408de5, 234b811, 6c70c82, and 8cb053f. Release notes are captured in the AgenticMail CHANGELOG.

Workarounds

Restrict network access to the AgenticMail API to trusted management networks until patched packages are deployed.
Front the API with a request filter that rejects storage requests containing HAVING, comma-joined FROM lists, or non-integer hour parameters.
Force tlsRejectUnauthorized: true in MailSender options for all non-loopback SMTP destinations.
Move worker secrets out of plain_text bindings into the platform secret store.

bash

# Upgrade AgenticMail packages to patched versions
npm install @agenticmail/api@^0.9.32 @agenticmail/core@^0.9.10

# Verify no plain_text OUTBOUND_SECRET remains in worker metadata
grep -R "OUTBOUND_SECRET" packages/core/src/gateway/workers/ && \
  echo "Remove plain_text OUTBOUND_SECRET binding" || echo "OK"