GHSA-r7x9-8ph7-w8cg
NoneCVSS
—
EPSS
—
Published
Feb 3, 2026
CISA due date
—
The record
Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email Routing
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | agents | 0 | 0.3.7 |
Related vulnerabilities
- CVE-2026-1664 Summary An Insecure Direct Object Reference has been found to exist in… Same vulnerability
- GHSA-w5cr-2qhr-jqc5 Cloudflare Agents has a Reflected Cross-Site Scripting (XSS) vulnerability in AI… Also affects agents
- GHSA-cvhv-6xm6-c3v4 Cloudflare Agents is Vulnerable to Reflected Cross-Site Scripting in the AI Playground's… Also affects agents
- CVE-2026-1721 Summary A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the AI… Also affects agents
- CVE-2026-13319 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before… CWE-639
- CVE-2026-111767 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and… CWE-639
- CVE-2026-105755 vLLM is an inference and serving engine for large language models. CWE-639
- CVE-2026-105754 vLLM is an inference and serving engine for large language models. CWE-639