CVE-2026-57494 in AgenticMail
Summary
by MITRE • 07/21/2026
AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supplying the target agent name to `GET /api/agenticmail/tasks/pending?assignee=<name>`. The returned task objects include the task IDs and payloads. The same task IDs can then be used with the capability-style task mutation endpoints (`/tasks/:id/claim`, `/tasks/:id/result`, `/tasks/:id/complete`, `/tasks/:id/fail`) to claim, complete, or fail tasks assigned to a different agent. Because ordinary authenticated agents can discover agent names through `GET /api/agenticmail/accounts/directory`, the task ID effectively stops being a secret capability. This turns the intended capability model into a cross-agent authorization bypass. Version 0.9.64 contains a fix.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
The vulnerability in AgenticMail's @agenticmail/api component represents a critical authorization bypass that undermines the system's capability-based security model. This flaw exists in versions prior to 0964 and allows low-privileged authenticated agents to enumerate and manipulate tasks assigned to other agents through a combination of information disclosure and privilege escalation techniques. The vulnerability stems from insufficient access controls on the task enumeration endpoint, which exposes sensitive task metadata including task IDs and payloads when querying pending tasks by assignee name. This design flaw creates a direct pathway for unauthorized task manipulation through capability-style mutation endpoints that should be restricted to authorized agents only.
The technical implementation of this vulnerability demonstrates a classic case of broken access control where the system fails to properly validate authorization boundaries between different agent instances. When an attacker supplies a target agent name to the GET /api/agenticmail/tasks/pending?assignee= endpoint, the system returns task objects containing identifiers that should remain confidential within the capability model. These task IDs function as de facto capabilities that enable unauthorized agents to claim, complete, or fail tasks belonging to other agents through direct manipulation of the system's task mutation endpoints. The vulnerability is particularly dangerous because it leverages the legitimate directory enumeration functionality that allows ordinary authenticated agents to discover agent names through GET /api/agenticmail/accounts/directory, creating a seamless attack chain from information gathering to privilege escalation.
The operational impact of this vulnerability extends beyond simple data exposure and represents a fundamental breakdown in the system's security architecture. An attacker can effectively impersonate other agents within the system by leveraging task IDs discovered through enumeration, potentially causing significant disruption to automated workflows and compromising the integrity of task processing. This authorization bypass undermines the core principle of capability-based security where access should be granted based on specific capabilities rather than broad permissions, transforming the system into one where any authenticated agent can manipulate tasks assigned to others. The vulnerability affects all agents within the system regardless of their privilege level, creating a widespread security risk that could lead to task hijacking, workflow disruption, and potential data corruption.
This vulnerability aligns with CWE-285 (Improper Authorization) and represents a specific instance of the broader category of cross-agent authorization bypasses that can occur in distributed systems. The ATT&CK framework categorizes this as privilege escalation through access control bypass techniques, specifically targeting the system's capability model implementation. The flaw demonstrates how seemingly innocuous API endpoints can create security vulnerabilities when proper authorization checks are not implemented across the entire system. Organizations implementing similar capability-based security models should consider this vulnerability pattern when designing their authorization mechanisms, particularly ensuring that identifiers and capabilities remain secret and that access controls are enforced at all levels of the system architecture. The fix implemented in version 0964 addresses the root cause by enforcing proper authorization checks on task enumeration endpoints, preventing unauthorized agents from discovering task details for other agents and maintaining the integrity of the capability-based security model.
The remediation approach required for this vulnerability involves implementing strict access controls that validate agent identity before exposing task information, ensuring that task IDs remain secret capabilities rather than discoverable resources. System administrators should also consider implementing additional monitoring for unusual patterns of task enumeration and mutation activity, as these operations may indicate unauthorized attempts to bypass the security model. Organizations using similar distributed agent systems should conduct comprehensive audits of their capability-based access controls to identify potential cross-agent authorization bypasses that could create similar vulnerabilities in their own implementations.