The vulnerability CVE-2026-57495 affects several @agenticmail packages before specified versions. Two inbound-mail handlers perform privileged actions without verifying the sender's identity, unlike a sibling handler that correctly gates operator replies. The more impactful handler allows any external email routed to the bridge inbox to resume the operator's Claude Code session with 'permissionMode: bypassPermissions'. This embeds attacker-controlled 'from', 'subject', and 'preview' fields directly into the prompt read by a fully privileged AI agent running as the operator's OAuth identity. This constitutes an indirect prompt injection leading to unauthorized execution of privileged operations. The issue is fixed in versions 0.2.39 (@agenticmail/claudecode), 0.1.33 (@agenticmail/codex), 0.9.43 (@agenticmail/core), and 0.5.71 (@agenticmail/openclaw).

An attacker can send an external email that triggers resumption of a privileged AI agent session with elevated permissions, embedding attacker-controlled content into the agent's prompt. This can lead to unauthorized execution of commands or actions with the operator's OAuth identity, potentially compromising confidentiality, integrity, and availability of the operator's environment. The vulnerability is rated high severity with a CVSS 4.0 score of 8.2, indicating significant risk if exploited.

Fixed versions are available: upgrade to @agenticmail/claudecode 0.2.39 or later, @agenticmail/codex 0.1.33 or later, @agenticmail/core 0.9.43 or later, and @agenticmail/openclaw 0.5.71 or later. No vendor advisory content is provided to indicate alternative mitigations or temporary fixes. Patch status is not explicitly confirmed but the description states these versions contain the fix. Users should upgrade to these versions to remediate the vulnerability.