agenticmail claudecode/codex/core/openclaw prior 0.2.39/0.1.33/0.9.43/0.5.71 Mail from/subject/preview permission

Summaryinfo

A vulnerability was found in agenticmail claudecode, codex, core and openclaw. It has been classified as critical. This issue affects some unknown processing of the component Mail Handler. This manipulation of the argument from/subject/preview causes permission. This vulnerability is handled as CVE-2026-57495. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical was found in agenticmail claudecode, codex, core and openclaw. Affected by this vulnerability is an unknown code block of the component Mail Handler. The manipulation of the argument from/subject/preview with an unknown input leads to a permission vulnerability. The CWE definition for the vulnerability is CWE-275. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/claudecode prior to version 0.2.39, @agenticmail/codex prior to version 0.1.33, @agenticmail/core prior to version 0.9.43, and @agenticmail/openclaw prior to version 0.5.71, two inbound-mail handlers act on a privileged effect without verifying that the sender is the operator, while a sibling handler in the same repo does. The higher-impact one: any external email routed to the bridge inbox causes the dispatcher to resume the operator's Claude Code session with `permissionMode: 'bypassPermissions'`, embedding the attacker-controlled `from`/`subject`/`preview` verbatim into the prompt the resumed agent reads — an indirect prompt injection into a fully-privileged agent (Bash/Write/Edit/WebFetch + the agenticmail MCP toolbelt) running as the operator's OAuth identity. The sibling operator-query email-reply hook gates the same untrusted-From provenance with `isOperatorReplySender(replyFrom, config.operatorEmail)` (fail-closed); the bridge-wake path — a strictly higher-privilege effect — has no equivalent. @agenticmail/claudecode 0.2.39, @agenticmail/codex 0.1.33, @agenticmail/core 0.9.43, and @agenticmail/openclaw 0.5.71 contain a fix.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-57495 since 06/24/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1222 according to MITRE ATT&CK.

Upgrading to version 0.2.39, 0.1.33, 0.9.43 or 0.5.71 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• agenticmail

Name

• claudecode
• codex
• core
• openclaw

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion