CVE-2026-47255 AgenticMail API/storage and outbound relay hardening
AgenticMail libraries contain SQL injection and credential handling flaws allowing attackers to execute code or access data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47255?
CVE-2026-47255 is a high-severity SQL injection vulnerability in @agenticmail/api, published on 20 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related to validation and and binding of inactive-agent hour filtering; storage SQL identifier validation; metadata-backed ownership checks for raw storage SQL; blocking direct storage metadata access through raw SQL; fail-closed outbound worker secret handling; SMTP envelope/header control-character validation before command construction; and TLS certificate verification as the default for MailSender with an explicit opt-out for local development. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 are patched.
Which versions are affected by CVE-2026-47255?
4 open source packages ship an affected version, including @agenticmail/api and @agenticmail/core.
| Package | Affected | Fixed in |
|---|---|---|
@agenticmail/api npm | All versions | 0.9.32 |
@agenticmail/api npm | All versions | 0.9.32 |
@agenticmail/core npm | All versions | 0.9.10 |
@agenticmail/core npm | All versions | 0.9.10 |
How do I fix CVE-2026-47255?
Upgrade @agenticmail/api to 0.9.32 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-47255 being exploited?
There is no known exploitation of CVE-2026-47255 in the wild and no public exploit code.
Sources
Also known as GHSA-wjjv-3mj2-39hf.