CVE-2026-1664: 
JavaScript vulnerability analysis and mitigation

CVE-2026-1664 is an Insecure Direct Object Reference (IDOR) vulnerability in the Cloudflare Agents SDK affecting the createHeaderBasedEmailResolver() function. It allows unauthenticated remote attackers to route inbound email to arbitrary Durable Object instances by spoofing Message-ID and References email headers. All versions of the agents npm package prior to 0.3.7 are affected. The vulnerability was published on February 3, 2026, with a CVSS v4.0 base score of 6.9 (Medium) (Github Advisory).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). The createHeaderBasedEmailResolver() function parses the Message-ID and References email headers to derive the target agentName and agentId for routing inbound mail, but performs no cryptographic verification or origin validation on these header values. Because email headers are fully attacker-controlled, an external sender can craft a malicious email with spoofed headers that reference arbitrary Durable Object namespaces and instance IDs, causing the SDK to route the message to unintended agent instances. No authentication or special privileges are required to exploit this vulnerability — only the ability to send an email to the target system (Github Advisory, Cloudflare Agents Repo).

Successful exploitation allows an attacker to steer inbound email to arbitrary Cloudflare Durable Object agent instances and namespaces that they should not have access to. This results in low confidentiality and integrity impacts on both the vulnerable system and subsequent systems, as unauthorized agents may receive and process email content intended for other instances. Availability is not directly impacted. The vulnerability could enable unauthorized access to agent state or trigger unintended agent behavior depending on how the targeted Durable Object processes received email (Github Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.023% (7th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires no authentication, no user interaction, and no special privileges — only the ability to send a crafted email — making it technically straightforward for any attacker with email access to the target system (Github Advisory).

1. Reconnaissance: Identify a target application built with the Cloudflare Agents SDK (npm package agents < 0.3.7) that uses createHeaderBasedEmailResolver() to handle inbound email via Cloudflare Email Routing.
2. Enumerate agent identifiers: Attempt to discover valid agentName and agentId values through application behavior, documentation, or error messages exposed by the target service.
3. Craft malicious email headers: Compose an email with spoofed Message-ID and/or References headers containing the target agentName and agentId values in the format expected by the resolver (e.g., Message-ID: <agentId.agentName@domain>).
4. Send the crafted email: Deliver the email to the address configured for the target Cloudflare Email Worker. The createHeaderBasedEmailResolver() function parses the headers without validation and routes the message to the specified Durable Object instance.
5. Achieve unauthorized access: The targeted agent instance receives and processes the email, potentially exposing its state, triggering unintended actions, or allowing the attacker to inject content into an agent session they should not have access to (Github Advisory).

• Email Logs: Inbound emails with Message-ID or References headers containing structured identifiers (e.g., UUIDs or agent name patterns) that do not correspond to legitimate prior outbound messages from the system.
• Application Logs: Unexpected Durable Object activations or agent instance lookups triggered by inbound email events, particularly for agent IDs not associated with known user sessions.
• Network: Email traffic from unknown or suspicious senders targeting the Cloudflare Email Worker address, especially with unusual or malformed header values.
• Behavioral: Agent instances receiving email that was not part of an established conversation thread (i.e., no matching prior Message-ID in sent mail logs) (Github Advisory).

Users of the Cloudflare Agents SDK should upgrade the agents npm package to version 0.3.7 or later, which refactors the createHeaderBasedEmailResolver() function to enforce strict identity boundaries and eliminate reliance on unvalidated header values for routing (Github Advisory). As a workaround prior to patching, developers can implement custom email resolver logic that validates the origin and authenticity of Message-ID and References headers before using them for routing decisions. The Cloudflare Agents email documentation at docs/email.md provides architectural context for implementing secure resolver patterns (Cloudflare Agents Repo).