Executive brief
Cloudflare Agents SDK is a framework for building AI agents that handle email communication. An insecure email routing flaw allows attackers to manipulate email headers to redirect inbound messages to arbitrary agent instances, potentially exposing mail intended for one service to attackers controlling different instances.
Technical details
The createHeaderBasedEmailResolver() function in Cloudflare Agents SDK (CWE-639: Insecure Direct Object Reference) lacks cryptographic verification or origin validation when parsing Message-ID and References email headers to determine the target agent instance and namespace for message routing. An external attacker who can control or spoof these headers can route inbound email messages to arbitrary Durable Object instances within the system without authentication. This requires only network access and the ability to send or intercept email with modified headers; no prior authentication or user interaction is required. The vulnerability allows an attacker to redirect emails intended for legitimate agent instances to instances under attacker control, potentially exposing sensitive message content or enabling email-based attacks. The fix is available in agents version 0.3.7 and later, which enforces strict identity boundaries and proper cryptographic verification of routing headers.
Affected products
- Cloudflare Agents SDK < 0.3.7
Timeline
- 2026-02-03: disclosed
- 2026-02-03: patched: agents@0.3.7 released