CVE-2026-1664: Cloudflare Agents SDK insecure direct object reference in email routing

CVE-2026-1664 · Severity: medium · CVSS 4 · Published 2026-02-03

Cloudflare Agents SDK is a framework for building AI agents that handle email communication. An insecure email routing flaw allows attackers to manipulate email headers to redirect inbound messages to arbitrary agent instances, potentially exposing mail intended for one service to attackers controlling different instances.

Vendors: Cloudflare.

Quick answers

Is CVE-2026-1664 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-1664 being exploited in the wild.
How severe is CVE-2026-1664?
Medium severity, with a CVSS score of 4, published 3 February 2026.
Which products and versions are affected?
Cloudflare Agents SDK < 0.3.7.
Is there a fix for CVE-2026-1664?
A patch was published on 2026-02-03: agents@0.3.7 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-1664 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-1664?
Check whether you run Cloudflare Agents SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The createHeaderBasedEmailResolver() function in Cloudflare Agents SDK (CWE-639: Insecure Direct Object Reference) lacks cryptographic verification or origin validation when parsing Message-ID and References email headers to determine the target agent instance and namespace for message routing. An external attacker who can control or spoof these headers can route inbound email messages to arbitrary Durable Object instances within the system without authentication. This requires only network access and the ability to send or intercept email with modified headers; no prior authentication or user interaction is required. The vulnerability allows an attacker to redirect emails intended for legitimate agent instances to instances under attacker control, potentially exposing sensitive message content or enabling email-based attacks. The fix is available in agents version 0.3.7 and later, which enforces strict identity boundaries and proper cryptographic verification of routing headers.

Affected products

  • Cloudflare Agents SDK < 0.3.7

Identifiers

  • CVE-2026-1664
  • GHSA-r7x9-8ph7-w8cg

Timeline

  • 2026-02-03: disclosed
  • 2026-02-03: patched: agents@0.3.7 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.