N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47255

CVE-2026-47255: AgenticMail API/storage and outbound relay hardening fixes

The current upstream main branch at commit 7e0206d was reviewed, and the fix-first patch set was rebased on 2026-05-18. The patches cover: validated and bound inactive-agent hour filtering; storage SQL identifier validation; metadata-backed ownership checks for raw storage SQL; blocking direct storage metadata access through raw SQL; fail-closed outbound worker secret handling; SMTP envelope/header control-character validation before command construction; and TLS certificate verification as the default for MailSender with an explicit opt-out for local development. Validation completed locally with targeted API/Core security tests plus API/Core builds. The security patch branch was not published publicly because te repository's SECURITY.md asks reporters not to open public vulnerability issues.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47255

CVE-2026-47255:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@agenticmail/api	npm	<= 0.9.31	0.9.32
@agenticmail/core	npm	<= 0.9.9	0.9.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The AgenticMail vulnerability GHSA-wjjv-3mj2-39hf is a composite of several high-severity issues across the API and core packages, primarily stemming from improper input validation. The root causes include:

SQL Injection: Multiple routes in the API (/storage/*, /accounts/inactive, /accounts/cleanup) constructed SQL queries by directly interpolating user-provided parameters (having, where keys, hours) without proper sanitization or use of parameterized queries. This allowed for classic SQL injection attacks.
Improper Access Control: The raw SQL storage endpoint failed to correctly identify all tables in a comma-joined query, allowing a user to craft a query that could access and exfiltrate data belonging to other users (cross-agent access).
Hardcoded Credentials: The outbound email relay worker contained a hardcoded secret key as a fallback. This key was publicly available in the source code, effectively nullifying authentication for the email relay service.
SMTP Injection: The same outbound worker did not validate email headers for control characters. This would allow an attacker to inject SMTP commands, leading to potential email spoofing or abuse of the relay.
Insecure Defaults (MITM): The MailSender component, responsible for sending emails, was configured by default to not verify TLS certificates. This made all outgoing email connections vulnerable to Man-in-the-Middle (MITM) attacks, where an attacker could intercept and read sensitive email content.

The patches address these issues by introducing strict input validation, moving to parameterized queries, removing hardcoded secrets, and enabling secure-by-default TLS verification.

Vulnerable functions

createStorageRoutes

packages/api/src/routes/storage.ts

The 'having' parameter from the user request was directly concatenated into an SQL query string without sanitization. This allowed for SQL injection attacks. The fix introduces the 'sanitizeHavingClause' function to validate and sanitize the input.

buildWhereClause

packages/api/src/routes/storage.ts

The key from the 'where' object in a user's request was used directly as a column name in the SQL query. This is a SQL injection vulnerability, as an attacker could provide a malicious key to manipulate the query. The fix validates the key as a proper identifier before use.

createAccountRoutes

packages/api/src/routes/accounts.ts

The 'hours' parameter from a user request was directly interpolated into an SQL query string. This could lead to SQL injection. The fix changes the code to use parameterized queries, which properly separates the query logic from the data.

outbound.fetch

packages/core/src/gateway/workers/outbound.js

The outbound worker used a hardcoded fallback secret key ('outbound_2sabi_secret_key') if the 'OUTBOUND_SECRET' environment variable was not set. Since this key was in the public repository, it allowed unauthorized users to send emails through the relay.

buildRawEmail

packages/core/src/gateway/workers/outbound.js

This function constructed raw emails without validating input fields like 'from', 'to', and 'subject' for control characters (e.g., newline). This lack of validation could allow an attacker to perform SMTP injection, potentially sending forged emails or exploiting the mail server.

MailSender.constructor

packages/core/src/mail/sender.ts

The MailSender class was configured to always disable TLS certificate verification ('rejectUnauthorized: false'). This makes all outgoing SMTP connections vulnerable to Man-in-the-Middle (MITM) attacks, as the client would not validate the authenticity of the mail server's certificate.

extractTableRefs

packages/api/src/routes/storage.ts

The function, used for ownership checks on raw SQL queries, only identified the first table in a FROM/JOIN clause. This allowed an attacker to bypass access controls and read data from other agents' tables by using a comma-join (e.g., `FROM my_table, other_agent_table`).

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.