GHSA-fq4x-789w-jg5h: AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)

Summary

AgenticMail's inbound mail handlers act on privileged effects without verifying the sender is the operator. In a configured headless-bridge deployment, an external email routed to the bridge inbox makes the dispatcher resume the operator's Claude Code session with permissionMode 'bypassPermissions', embedding the attacker-controlled from, subject and preview verbatim into the prompt. The gap is structural: the bridge-wake path lacks the isOperatorReplySender check that its sibling operator-query reply hook uses in the same repo.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• HighCVE-2026-88968: Claude Code Edit tool symlink race overwrites files outside workspace on macOSSame vendor · NVD/CVE Database
• HighCVE-2026-88066: Claude Desktop on Windows git.exe execution via search pathSame vendor · NVD/CVE Database
• HighCVE-2026-62331: praktor path traversal via Telegram document upload filenamesSame vendor · NVD/CVE Database
• MediumGHSA-w4fh-qvv9-3v23: Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource serverSame vendor · GitHub Advisory Database
• MediumGHSA-5h93-6whr-6q8j: Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodiesSame vendor · GitHub Advisory Database