CVE-2026-1664

Summary An Insecure Direct Object Reference has been found to exist in "createHeaderBasedEmailResolver" function within the Cloudflare Agents SDK. The issue occurs because the "Message-ID" and "References" headers are parsed to derive the target agentName and agentId without proper validation or...