CVE-2026-57494 AgenticMail: Cross-agent task authorization bypass in AgenticMail API
An authenticated agent can enumerate and manipulate tasks belonging to other agents, bypassing intended capability-based authorization controls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-57494?
CVE-2026-57494 is a high-severity missing authorization vulnerability in @agenticmail/api, published on 20 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supplying the target agent name to `GET /api/agenticmail/tasks/pending?assignee=<name>`. The returned task objects include the task IDs and payloads. The same task IDs can then be used with the capability-style task mutation endpoints (`/tasks/:id/claim`, `/tasks/:id/result`, `/tasks/:id/complete`, `/tasks/:id/fail`) to claim, complete, or fail tasks assigned to a different agent. Because ordinary authenticated agents can discover agent names through `GET /api/agenticmail/accounts/directory`, the task ID effectively stops being a secret capability. This turns the intended capability model into a cross-agent authorization bypass. Version 0.9.64 contains a fix.
Which versions are affected by CVE-2026-57494?
2 open source packages ship an affected version, including @agenticmail/api.
| Package | Affected | Fixed in |
|---|---|---|
@agenticmail/api npm | All versions | 0.9.64 |
@agenticmail/api npm | All versions | 0.9.64 |
How do I fix CVE-2026-57494?
Upgrade @agenticmail/api to 0.9.64 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-57494 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-57494 exists.
Sources
Also known as GHSA-hjwc-26pj-v3pm.