CVE-2026-57494: AgenticMail Auth Bypass Vulnerability

CVE-2026-57494 Overview

CVE-2026-57494 is a cross-agent authorization bypass in AgenticMail, a service that assigns AI agents real email addresses and phone numbers. The flaw affects @agenticmail/api versions prior to 0.9.64. A low-privileged authenticated agent can enumerate another agent's pending or claimed tasks by supplying a target agent name to the GET /api/agenticmail/tasks/pending?assignee=<name> endpoint. The response includes task IDs and payloads that the caller can then use with capability-style mutation endpoints. The weakness is classified as [CWE-639] Authorization Bypass Through User-Controlled Key.

Critical Impact
Any authenticated agent can claim, complete, or fail tasks belonging to other agents, breaking the capability model that protects inter-agent task isolation.

Affected Products

@agenticmail/api versions prior to 0.9.64
AgenticMail agent task orchestration service
Deployments exposing the AgenticMail HTTP API to multi-tenant agents

Discovery Timeline

2026-07-20 - CVE-2026-57494 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-57494

Vulnerability Analysis

AgenticMail exposes a task queue that agents use to receive work items addressed to their identity. The intended design treats each task ID as a secret capability: knowing the ID is equivalent to being authorized to act on the task. The GET /api/agenticmail/tasks/pending endpoint accepts an assignee query parameter without verifying that the caller matches the requested assignee. As a result, any authenticated agent can list tasks intended for another agent and receive both the identifiers and payload contents.

Once the caller holds a task ID, the mutation endpoints /tasks/:id/claim, /tasks/:id/result, /tasks/:id/complete, and /tasks/:id/fail accept operations without checking that the caller owns the task. This chain converts an enumeration flaw into a full cross-agent authorization bypass.

Root Cause

The server relies on task ID secrecy for authorization instead of validating the authenticated principal against the task assignee. Because the same authenticated tier can also list agent names through GET /api/agenticmail/accounts/directory, the assignee parameter is trivially discoverable. The capability model collapses when the identifiers protected by that model are enumerable by unrelated callers.

Attack Vector

An attacker registers or compromises any low-privileged AgenticMail agent account. The attacker queries the accounts directory to enumerate valid agent names, then issues pending-task queries for each target assignee. Returned task IDs feed directly into the mutation endpoints, allowing the attacker to hijack, drop, or corrupt work items belonging to other agents. Exploitation requires only network access to the API and standard authenticated credentials.

See the GitHub Security Advisory GHSA-hjwc-26pj-v3pm for technical details published by the maintainers.

Detection Methods for CVE-2026-57494

Indicators of Compromise

Requests to GET /api/agenticmail/tasks/pending?assignee=<name> where the assignee value does not match the authenticated agent identity.
Sequential or high-volume queries against GET /api/agenticmail/accounts/directory followed by pending-task lookups.
Calls to /tasks/:id/claim, /tasks/:id/complete, /tasks/:id/result, or /tasks/:id/fail where the acting agent differs from the task's originally assigned agent.

Detection Strategies

Correlate API access logs to flag any session that queries pending tasks for an assignee other than itself.
Alert on task state transitions when the mutating principal does not equal the assignee recorded at task creation.
Track directory enumeration patterns that immediately precede task-pending queries for multiple distinct assignees.

Monitoring Recommendations

Enable verbose audit logging on all /api/agenticmail/tasks/* and /api/agenticmail/accounts/directory endpoints.
Forward AgenticMail API logs to a centralized analytics pipeline for cross-agent behavioral baselining.
Review historical task lifecycle records for mismatches between assignee and mutator agents dating back to service deployment.

How to Mitigate CVE-2026-57494

Immediate Actions Required

Upgrade @agenticmail/api to version 0.9.64 or later on all AgenticMail deployments.
Rotate agent credentials and invalidate outstanding task IDs to defeat previously harvested capabilities.
Audit task history for state transitions performed by an agent other than the assignee and reconcile impacted workflows.

Patch Information

Version 0.9.64 of @agenticmail/api contains the fix. The maintainers document the update in the GitHub Security Advisory GHSA-hjwc-26pj-v3pm. Patched builds enforce that the authenticated principal matches the requested assignee and that task mutations validate ownership rather than relying on ID secrecy.

Workarounds

Restrict the AgenticMail API to trusted network segments until the patched version is deployed.
Place an authenticating reverse proxy in front of /api/agenticmail/tasks/pending that rejects requests where the assignee parameter differs from the authenticated agent name.
Temporarily disable the accounts directory endpoint to slow agent-name enumeration by low-privileged callers.

bash

# Upgrade the AgenticMail API package to the fixed release
npm install @agenticmail/api@0.9.64

# Verify the installed version
npm ls @agenticmail/api