CVE-2026-57495: AgenticMail Auth Bypass Vulnerability

CVE-2026-57495 Overview

CVE-2026-57495 is a missing authentication vulnerability [CWE-306] in AgenticMail, a service that provisions real email addresses and phone numbers for AI agents. Two inbound-mail handlers in the AgenticMail packages act on privileged effects without verifying that the sender is the operator. The bridge-wake handler resumes the operator's Claude Code session with permissionMode: 'bypassPermissions' and embeds attacker-controlled from, subject, and preview fields directly into the prompt. This creates an indirect prompt injection into a fully-privileged agent with access to Bash, Write, Edit, WebFetch, and the agenticmail MCP toolbelt, running under the operator's OAuth identity.

Critical Impact
Any external email sent to the bridge inbox can hijack the operator's privileged AI agent session, enabling arbitrary command execution under the operator's identity.

Affected Products

@agenticmail/claudecode prior to version 0.2.39
@agenticmail/codex prior to version 0.1.33
@agenticmail/core prior to version 0.9.43
@agenticmail/openclaw prior to version 0.5.71

Discovery Timeline

2026-07-20 - CVE-2026-57495 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-57495

Vulnerability Analysis

AgenticMail assigns AI agents real inbound email addresses. The dispatcher routes messages to handlers that trigger privileged effects on behalf of the operator. Two of these handlers dispatch without validating message provenance, exposing the agent runtime to any external sender.

The higher-impact path is the bridge-wake handler. When any external email reaches the bridge inbox, the dispatcher resumes the operator's Claude Code session with permissionMode: 'bypassPermissions'. Attacker-controlled from, subject, and preview fields are inserted verbatim into the prompt the resumed agent reads. The agent runs with Bash, Write, Edit, WebFetch, and the full agenticmail MCP toolbelt under the operator's OAuth identity.

The result is an indirect prompt injection into a fully-privileged agent. Attackers can steer the agent to execute shell commands, modify files, exfiltrate data, or make outbound web requests as the operator.

Root Cause

The root cause is missing authentication for a critical function [CWE-306]. A sibling operator-query email-reply hook in the same repository correctly gates the untrusted From header using isOperatorReplySender(replyFrom, config.operatorEmail), failing closed when the sender does not match. The bridge-wake path, which triggers a strictly higher-privilege effect, has no equivalent sender verification.

Attack Vector

Exploitation requires only the ability to send email. An attacker sends a crafted message to the AgenticMail bridge inbox address. The dispatcher wakes the operator's Claude Code session in bypass-permissions mode and feeds the attacker's from, subject, and preview fields into the prompt. The resumed agent interprets the injected content as instructions and executes them with full operator privileges. No user interaction is required on the operator side.

Detection Methods for CVE-2026-57495

Indicators of Compromise

Inbound emails to the AgenticMail bridge inbox from senders outside the operator's known address list.
Unexpected Claude Code session resumptions correlated with inbound-mail events.
Agent-initiated shell commands, file writes, or outbound WebFetch calls that lack a corresponding operator-initiated task.
MCP tool invocations against agenticmail endpoints originating from resumed sessions with bypassPermissions set.

Detection Strategies

Correlate inbound SMTP events with agent-session resume events to flag sessions triggered by non-operator senders.
Log and alert on any agent session started with permissionMode: 'bypassPermissions' following an external email trigger.
Inspect prompt payloads for prompt-injection markers such as instruction-like phrasing embedded in from, subject, or preview fields.

Monitoring Recommendations

Enable verbose audit logging on the AgenticMail dispatcher for all handler invocations, capturing sender, headers, and resulting effect.
Monitor outbound network calls from agent workloads for connections to unrecognized domains.
Track file system writes and shell command execution originating from Claude Code sessions and alert on anomalies.

How to Mitigate CVE-2026-57495

Immediate Actions Required

Upgrade @agenticmail/claudecode to 0.2.39, @agenticmail/codex to 0.1.33, @agenticmail/core to 0.9.43, and @agenticmail/openclaw to 0.5.71.
Audit inbound-mail logs for external messages delivered to bridge inboxes since deployment.
Review recent Claude Code session activity for unauthorized command execution or data access.
Rotate the operator's OAuth credentials if compromise is suspected.

Patch Information

The maintainers released fixed versions across all four packages. Details are available in the GitHub Security Advisory GHSA-fq4x-789w-jg5h. The fix adds operator-sender verification to the bridge-wake handler, aligning it with the fail-closed check already present in the sibling email-reply hook.

Workarounds

Restrict the bridge inbox address to accept mail only from verified operator addresses at the mail-transfer-agent level.
Disable the bridge-wake handler until the upgrade is applied.
Remove bypassPermissions from the resumed session configuration and require explicit operator approval for tool use.

bash

# Upgrade AgenticMail packages to patched versions
npm install @agenticmail/claudecode@0.2.39
npm install @agenticmail/codex@0.1.33
npm install @agenticmail/core@0.9.43
npm install @agenticmail/openclaw@0.5.71