HighVulnerabilityLLM-specific
CVE-2026-57495: AgenticMail bridge resumes privileged sessions without sender check
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-57495
- Published
- Record updated
- Affected
- @agenticmail/core < 0.9.43, fixed in 0.9.43, released June 18, 2026, 32 days before disclosure
- @agenticmail/claudecode < 0.2.39, fixed in 0.2.39, released June 18, 2026, 32 days before disclosure
- @agenticmail/codex < 0.1.33, fixed in 0.1.33, released June 18, 2026, 32 days before disclosure
- and 1 more
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.4%
Summary
Two inbound-mail handlers in AgenticMail's @agenticmail/claudecode, @agenticmail/codex, @agenticmail/core and @agenticmail/openclaw packages act on privileged effects without checking that the sender is the operator, unlike a sibling handler that does. The most serious path lets any external email routed to the bridge inbox resume the operator's Claude Code session with `permissionMode: 'bypassPermissions'`, embedding attacker-controlled `from`, `subject` and `preview` fields into the prompt the agent reads.
Mitigation
Fixed in @agenticmail/claudecode 0.2.39, @agenticmail/codex 0.1.33, @agenticmail/core 0.9.43 and @agenticmail/openclaw 0.5.71.
Topics
Related items
- InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
- InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
- MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog
- MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research
- InfoRight Tool, Wrong Parameters: Defending LLM Agents Against Parameter PoisoningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)