High, CVSS 8.2npmAmendedPublished
AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)
CVE-2026-57495 · GHSA-fq4x-789w-jg5h
- Affected
- npm @agenticmail/openclaw < 0.5.71
- Fixed in
- 0.5.71· Vendor fix available
- Issue
- Two inbound-mail handlers act on a privileged effect without verifying that the sender is the operator, while a sibling handler in the same repo does. The higher-impact one: any external email routed to the bridge inbox causes the dispatcher to resume the operator's Claude Code session with permissionMode: 'bypassPermissions', embedding the attacker-controlled from/subject/preview verbatim into the prompt the resumed agent reads — an indirect prompt injection into a fully-privileged agent (Bash/Write/Edit/WebFetch + the agenticmail MCP toolbelt) running as the operator's OAuth identity. The sibling operator-query email-reply hook gates the same untrusted-From provenance with isOperatorReplySender(replyFrom, config.operatorEmail) (fail-closed); the bridge-wake path — a strictly higher-privilege effect — has no equivalent. Affected code (current HEAD, commit b95f52e) Untrusted provenance: external inbound email enters at packages/api/src/routes/inbound.ts:41 (POST…
Recommended action: Upgrade to 0.5.71 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.