CVE-2026-57494
Summary
A low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supplying the target agent name to GET /api/agenticmail/tasks/pending?assignee=<name>. The returned task objects include the task IDs and payloads. The same task IDs can then be used with the capability-style task mutation endpoints (/tasks/:id/claim, /tasks/:id/result, /tasks/:id/complete, /tasks/:id/fail) to claim, complete, or fail tasks assigned to a different agent.
Because ordinary authenticated agents can discover agent names through GET /api/agenticmail/accounts/directory, the task ID effectively stops being a secret capability. This turns the intended capability model into a cross-agent authorization bypass.
Affected component
Package: @agenticmail/api
Observed version: 0.9.62
Repository: agenticmail/agenticmail
Relevant code paths:
- packages/api/src/app.ts: createAuthMiddleware(...) is mounted before createAccountRoutes(...) and createTaskRoutes(...), so these routes are reachable by any valid bearer token.
- packages/api/src/routes/accounts.ts: GET /accounts/directory is available to any authenticated user and returns agent names.
- packages/api/src/routes/tasks.ts: GET /tasks/pending?assignee=name resolves arbitrary agent names and returns that agent's pending/claimed tasks.
- packages/api/src/routes/tasks.ts: /tasks/:id/claim, /tasks/:id/result, /tasks/:id/complete, /tasks/:id/fail, and /tasks/:id do not check whether the authenticated caller is the task assignee, assigner, or otherwise authorized for the task.
Impact
An attacker only needs a valid agent API key. They can:
1. List agent names using /accounts/directory.
2. Query another agent's task queue using /tasks/pending?assignee=<victimName>.
3. Read sensitive task payloads intended for the victim agent.
4. Use the disclosed task ID to complete/fail/claim the victim's task or submit attacker-controlled results.
Local reproduction
I reproduced this locally with a focused Vitest
⚡ Watch CVE-2026-57494
Get an email if CVE-2026-57494 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.22% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 13% of all EPSS-scored CVEs.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-57494)