CVE-2026-47255: Agenticmail @agenticmail/api

High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days.

AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related to validation and and binding of inactive-agent hour filtering; storage SQL identifier validation; metadata-backed ownership checks for raw storage SQL; blocking direct storage metadata access through raw SQL; fail-closed outbound worker secret handling; SMTP envelope/header control-character validation before command construction; and TLS certificate verification as the default for MailSender with an explicit opt-out for local development. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 are patched.

Affected products

• Agenticmail @agenticmail/api: before 0.9.32 (fixed in 0.9.32)
• Agenticmail @agenticmail/core: before 0.9.10 (fixed in 0.9.10)

Published 2026-07-20. Last modified 2026-07-23.