CVE-2026-54649

Overview

CVE-2026-54649 is an information disclosure vulnerability in the punchin-email Cloudflare Email Worker prior to version 1.5.0. The vulnerability occurs because the handleInbound function uses message.forward(), which silently drops the added Reply-To header meant for routing responses through the relay. This causes email replies to bypass the alias and expose the operator's private inbox address directly to correspondents.

Description

punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward(), which silently drops the added Reply-To header intended to route responses through the relay. When a correspondent sends mail to an alias and the operator replies, the mail client can send directly to the correspondent from the private FORWARD_TO inbox address, exposing that address. The disclosure is limited to the operator's own email address and does not expose third-party data or provide code execution or authentication bypass. This issue is fixed in version 1.5.0.

Impact

This vulnerability impacts confidentiality by exposing the operator's private forwarding email address to external correspondents upon reply. Integrity and availability are not affected, and the issue does not provide code execution, authentication bypass, or access to third-party data. Only the operator's own email address is disclosed.

Remediation

Defenders must update the punchin-email Cloudflare Email Worker to version 1.5.0 or later where the email routing and header handling logic has been fixed. Review deployment configurations to ensure updates are successfully applied across all active instances.

Risk context

The vulnerability is rated as high severity with a CVSS v3 score of 8.2, though EPSS data is currently unavailable. Despite the high CVSS score, the risk is limited to metadata and email address disclosure for system operators rather than system compromise or broader data breaches.

Affected products

• punchin-email < 1.5.0