AgenticMail Multiple Validation & SQL Binding Weaknesses (Agent Email/Phone Infrastructure)
First seen Jul 21, 2026 · Updated Jul 21, 2026 · CVSS 8.2
AgenticMail, a platform that gives AI agents real email addresses and phone numbers, contained a cluster of validation and security-control weaknesses across its API and core packages. These include SQL identifier injection risks, insufficient SMTP header/envelope sanitization enabling command injection, fail-open secret handling, and TLS verification defaulting incorrectly in some configurations. Combined, these flaws could let an attacker manipulate agent-controlled email infrastructure, access or corrupt storage metadata, inject SMTP commands, or intercept traffic via weakened TLS defaults.
Technical Analysis
The vulnerability is actually a bundle of related weaknesses in @agenticmail/api (pre-0.9.32) and @agenticmail/core (pre-0.9.10): unvalidated/unbound SQL identifiers used in raw storage queries (risk of SQL injection or unauthorized metadata access), missing ownership checks before raw storage SQL execution, lack of control-character validation in SMTP envelope/header construction (enabling SMTP command/header injection), fail-open behavior for outbound worker secrets, and TLS certificate verification not being enforced by default for MailSender in some deployment paths. The entry point is any agent or workflow that interacts with AgenticMail's storage layer or sends outbound email — an attacker (or a compromised upstream agent) could exploit these to escalate access to storage metadata across agent boundaries, forge/manipulate outbound mail, or bypass TLS to conduct MITM attacks against agent-to-agent or agent-to-human email communications. Because AgenticMail assigns real email/phone identities to AI agents, exploitation could enable identity spoofing of an agent's communication channel, cross-tenant data exposure, or injection of malicious content into email-based agent workflows.
Affected Systems
AgenticMail (@agenticmail/api, @agenticmail/core); protocols: SMTP
Detection Signatures
- Outbound SMTP messages containing embedded CR/LF or control characters in header/envelope fields
- Raw SQL queries against storage metadata tables lacking bound/validated identifiers
- Unexpected TLS handshake failures suppressed or bypassed for MailSender connections in non-dev environments
- Worker processes continuing to operate after failed secret retrieval (fail-open logging pattern)
- Unauthorized access attempts to storage metadata outside expected agent/tenant ownership scope
Remediation Steps
- 1
Upgrade immediately
Update @agenticmail/api to >= 0.9.32 and @agenticmail/core to >= 0.9.10, which contain the patched validation and binding logic.
- 2
Audit outbound email logs
Review historical SMTP envelope/header data for control-character anomalies indicating attempted command injection.
- 3
Enforce TLS verification explicitly
Confirm MailSender configurations do not rely on default behavior; explicitly enable certificate verification in all non-local environments.
- 4
Review storage access controls
Audit raw SQL storage queries and metadata access paths for missing ownership checks, and add parameterized/bound identifier validation.
- 5
Rotate outbound worker secrets
Rotate any secrets used by outbound mail workers, since fail-open handling may have allowed operation with invalid or missing credentials.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.