PT-2026-45046 · Agenticmail+2 · @Agenticmail/Api+2

CVE-2026-47255 · Published 2026-05-29 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions @agenticmail/api versions prior to 0.9.32 @agenticmail/core versions prior to 0.9.10

Description Multiple security weaknesses exist involving improper validation and handling of data. These include issues with the validation and binding of inactive-agent hour filtering, storage SQL identifier validation, and metadata-backed ownership checks for raw storage SQL. Additionally, the software fails to block direct storage metadata access through raw SQL and lacks fail-closed outbound worker secret handling. There is also a lack of control-character validation for SMTP envelopes and headers before command construction, and TLS certificate verification was not the default for MailSender.

Recommendations Update @agenticmail/api to version 0.9.32 or later. Update @agenticmail/core to version 0.9.10 or later.

Exploit

Fix

Using Hardcoded Credentials

Improper Access Control

SQL injection

Cleartext Transmission of Sensitive Information

RCE

Weakness Enumeration

CWE-798

CWE-284

CWE-89

CWE-319

CWE-20

Related Identifiers

CVE-2026-47255

GHSA-WJJV-3MJ2-39HF

Affected Products

@Agenticmail/Api

@Agenticmail/Core

Agenticmail

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47255.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-47255 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wjjv-3mj2-39hf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47255 · Security Note
• https://github.com/agenticmail/agenticmail/commit/1408de543fa3577d8c2d4fdb289c75fe6faafac7 · Note
• https://github.com/agenticmail/agenticmail/blob/7b9b05d973676e9f3d097c08b8e649f59bfc15d0/packages/core/src/mail/sender.ts#L33 · Note
• https://github.com/agenticmail/agenticmail/security/advisories/GHSA-wjjv-3mj2-39hf · Note
• https://github.com/agenticmail/agenticmail/commit/6c70c8254c906f823392d7f5ccee88a5481e7731 · Note
• https://github.com/agenticmail/agenticmail/commit/234b811e426a0743170f3b10bc43419d64330155 · Note
• https://github.com/agenticmail/agenticmail/commit/8cb053f2307dd77b7736ffa0d7df04b0ccc3272d · Note
• https://github.com/agenticmail/agenticmail/blob/7b9b05d973676e9f3d097c08b8e649f59bfc15d0/CHANGELOG.md?plain=1#L1842 · Note
• https://github.com/agenticmail/agenticmail · Note
• https://t.me/CVEtracker/60744 · Telegram Post
• https://t.me/cveNotify/208277 · Telegram Post