CVE-2026-54649: punchin-email: Operator inbox (FORWARD_TO) disclosed to correspondents on reply — Cloudflare forward() drops the relay Reply-To
punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward(), which silently drops the added Reply-To header intended to route responses through the relay. When a correspondent sends mail to an alias and the operator replies, the mail client can send directly to the correspondent from the private FORWARDTO inbox address, exposing that address. The disclosure is limited to the operator's own email address and does not expose third-party data or provide code execution or authentication bypass. This issue is fixed in version 1.5.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
punchin-emailto a version that resolves this vulnerability.Fixed in 1.5.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Operators using punchin-email versions prior to 1.5.0 who receive alias mail and reply from their private FORWARD_TO inbox are exposed. Correspondents receiving those replies may see the operator's private inbox address.
What user action is needed for the address disclosure to occur?
A correspondent must first send mail to an alias, and the operator must reply to that message. The reply can then be sent directly from the private FORWARD_TO address because the relay Reply-To header was dropped.
Does this expose other data or enable account compromise?
No. The disclosure is limited to the operator's own email address; the provided information does not indicate exposure of third-party data, code execution, or authentication bypass.
What version resolves the issue?
Upgrade punchin-email to version 1.5.0, which fixes the Reply-To handling issue.