{"data":{"id":"9caf192b-44bb-4d8a-9768-d6e8996b4817","title":"CVE-2026-57494: AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a…","summary":"CVE-2026-57494 affects @agenticmail/api before version 0.9.64. A low-privileged authenticated agent can list another agent's pending and claimed tasks through GET /api/agenticmail/tasks/pending?assignee=<name>, which returns task IDs and payloads. Those IDs can then be used on the /tasks/:id/claim, /result, /complete and /fail endpoints to act on tasks assigned to a different agent, because agent names are discoverable via GET /api/agenticmail/accounts/directory.","solution":"Fixed in 0.9.64.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57494","publishedAt":"2026-07-20T22:17:16.970Z","cveId":"CVE-2026-57494","cweIds":["CWE-639","CWE-862"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["@agenticmail/api@< 0.9.64 (fixed: 0.9.64)"],"affectedPackageNames":["@agenticmail/api"],"affectedPackageRefs":["npm:@agenticmail/api"],"affectedVendors":[],"affectedVendorsRaw":["AgenticMail"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"AgenticMail cross-agent task access through pending task enumeration","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00273,"epssCheckedAt":"2026-11-12T15:03:08.295Z","kevDateAdded":null,"advisoryAliases":["GHSA-hjwc-26pj-v3pm"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:46:20.322Z","patchAvailable":true,"disclosureDate":"2026-07-20T22:17:16.970Z","fixReleasedAt":"2026-06-18T04:52:42.566Z","daysToFix":-32,"fixCheckedAt":"2026-10-29T21:32:58.292Z","capecIds":["CAPEC-122"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"@agenticmail/api","fixedVersion":"0.9.64","matchedVersion":"0.9.64","fixReleasedAt":"2026-06-18T04:52:42.566Z","daysToFix":-32,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:32:58.145Z"}]}}