CVE-2026-57495 is a HIGH-severity vulnerability in AgenticMail's AI agent email and phone number implementation. In @agenticmail/claudecode prior to 0.2.39, @agenticmail/codex prior to 0.1.33, @agenticmail/core prior to 0.9.43, and @agenticmail/openclaw prior to 0.5.71, two inbound-mail handlers allow an external attacker to inject prompts into a privileged agent session. The vulnerability enables attacke [truncated]
CVE-2026-57494 is a high-severity vulnerability in the AgenticMail API that allows low-privileged authenticated agents to enumerate and manipulate tasks assigned to other agents. This issue, fixed in version 0.9.64, enables unauthorized access to task IDs and payloads, effectively bypassing the intended capability model. Defenders should assess exposure, prioritize remediation, and verify inventory for Ag [truncated]
CVE-2026-50287 is a HIGH severity vulnerability in AgenticMail. Prior to version 0.9.27, @agenticmail/mcp exposes a Streamable HTTP transport when started with --http or MCP_HTTP=1. In that mode, the /mcp endpoint accepts requests without any HTTP authentication layer. A remote client can initialize a session and call tools directly. This issue has been patched in version 0.9.27.
