PT-2026-6054 · Cloudflare · Cloudflare Agents Sdk
Asukalangley
·
Publicado
2026-02-03
·
Atualizado
2026-02-03
·
CVE-2026-1664
CVSS v4.0
6.9
Média
| Vetor | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Cloudflare Agents SDK versions prior to 0.3.7
Description
An Insecure Direct Object Reference exists in the
createHeaderBasedEmailResolver() function. The issue arises because the Message-ID and References headers are parsed to determine the target agentName and agentId without sufficient validation or origin checks. This allows an attacker who can control these headers to route inbound mail to arbitrary Durable Object instances and namespaces. The root cause is a lack of cryptographic verification or origin validation for the headers used in the routing logic, enabling external input to dictate internal object routing. This IDOR in email routing allows an attacker to steer inbound mail to arbitrary Agent instances via a spoofed Message-ID.Recommendations
Upgrade to agents@0.3.7 to resolve the issue.
Refactor the resolver to enforce strict identity boundaries, as described in the provided PR.
Correção
IDOR
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Cloudflare Agents Sdk