info:
  name: AgenticMail
  cve: CVE-2026-47255
  summary: AgenticMail API and core had multiple input validation, access control,
    and hardening weaknesses including SQL injection, hard-coded credentials, cleartext
    transmission, and improper access control
  details: 'AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api
    prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weaknesses
    related to: (1) validation and binding of inactive-agent hour filtering; (2) storage
    SQL identifier validation (SQL injection risk, CWE-89); (3) metadata-backed ownership
    checks for raw storage SQL (improper access control, CWE-284); (4) blocking direct
    storage metadata access through raw SQL; (5) fail-closed outbound worker secret
    handling (use of hard-coded credentials, CWE-798); (6) SMTP envelope/header control-character
    validation before command construction (improper input validation, CWE-20); and
    (7) TLS certificate verification as the default for MailSender with an explicit
    opt-out for local development (cleartext transmission of sensitive information,
    CWE-319). These issues are patched in @agenticmail/api version 0.9.32 and @agenticmail/core
    version 0.9.10.

    Note: The AgenticMail fingerprint has a version extractor via /api/agenticmail/health
    which returns the @agenticmail/api package version. The affected versions are
    @agenticmail/api < 0.9.32 and @agenticmail/core < 0.9.10. Since the API package
    version is exposed and the core version is bundled within it (api v0.9.32 includes
    core v0.9.10+), the rule condition below uses the API version as the detectable
    boundary.'
  cvss: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
  severity: HIGH
  security_advise: Upgrade @agenticmail/api to version 0.9.32 or later and @agenticmail/core
    to version 0.9.10 or later. Ensure TLS certificate verification is enabled for
    outbound mail. Review SQL queries for parameterization and validate all SQL identifiers.
    Restrict metadata access through proper API endpoints rather than raw SQL.
rule: version < "0.9.32"
references:
- https://github.com/agenticmail/agenticmail/security/advisories/GHSA-wjjv-3mj2-39hf
- https://github.com/agenticmail/agenticmail/commit/1408de543fa3577d8c2d4fdb289c75fe6faafac7
- https://github.com/agenticmail/agenticmail/commit/234b811e426a0743170f3b10bc43419d64330155
- https://github.com/agenticmail/agenticmail/commit/6c70c8254c906f823392d7f5ccee88a5481e7731
- https://github.com/agenticmail/agenticmail/commit/8cb053f2307dd77b7736ffa0d7df04b0ccc3272d