{"id":"EUVD-2026-46121","revision":"23a5c0c7b2d646dbb0e793e1a4fa15b6","records":[{"revision":"23a5c0c7b2d646dbb0e793e1a4fa15b6","observedAt":"2026-11-05T10:05:44.522+00:00","statement":{"source":"euvd","id":"EUVD-2026-46121","aliases":["CVE-2026-47255","GHSA-wjjv-3mj2-39hf"],"title":"AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related to validation and and binding of inactive-agent hour filtering; …","description":"AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related to validation and and binding of inactive-agent hour filtering; storage SQL identifier validation; metadata-backed ownership checks for raw storage SQL; blocking direct storage metadata access through raw SQL; fail-closed outbound worker secret handling; SMTP envelope/header control-character validation before command construction; and TLS certificate verification as the default for MailSender with an explicit opt-out for local development. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 are patched.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","score":8.2,"severity":null}],"references":["https://github.com/agenticmail/agenticmail/security/advisories/GHSA-wjjv-3mj2-39hf","https://github.com/agenticmail/agenticmail/commit/1408de543fa3577d8c2d4fdb289c75fe6faafac7","https://github.com/agenticmail/agenticmail/commit/234b811e426a0743170f3b10bc43419d64330155","https://github.com/agenticmail/agenticmail/commit/6c70c8254c906f823392d7f5ccee88a5481e7731","https://github.com/agenticmail/agenticmail/commit/8cb053f2307dd77b7736ffa0d7df04b0ccc3272d","https://github.com/agenticmail/agenticmail/blob/7b9b05d973676e9f3d097c08b8e649f59bfc15d0/CHANGELOG.md?plain=1#L1842","https://github.com/agenticmail/agenticmail/blob/7b9b05d973676e9f3d097c08b8e649f59bfc15d0/packages/core/src/mail/sender.ts#L33"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-46121","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 20, 2026, 9:56:40 PM","dateUpdated":"Jul 21, 2026, 2:06:27 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-46121","identifiers":["EUVD-2026-46121","CVE-2026-47255","GHSA-wjjv-3mj2-39hf"]},"retained":false,"historicalAffected":[]}],"coverage":[]}