CVE-2026-1664

Summary An Insecure Direct Object Reference has been found to exist in "createHeaderBasedEmailResolver" function within the Cloudflare Agents SDK. The issue occurs because the "Message-ID" and "References" headers are parsed to derive the target agentName and agentId without proper validation or...

CVE-2026-1664: Authorization Bypass Through User-Controlled Key

Summary An Insecure Direct Object Reference has been found to exist in createHeaderBasedEmailResolver function within the Cloudflare Agents SDK. The issue occurs because the Message-ID and References headers are parsed to derive the target agentName and agentId without proper validation or origin...