8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-50287

CVE-2026-50287: Missing Authentication for Critical Function in @agenticmail/mcp

AgenticMail gives AI agents real email addresses and phone numbers. Prior to version 0.9.27, @agenticmail/mcp exposes a Streamable HTTP transport when started with --http or MCP_HTTP=1. In that mode, the /mcp endpoint accepts requests without any HTTP authentication layer. A remote client can initialize a session and call tools directly. This issue has been patched in version 0.9.27.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-50287

CVE-2026-50287:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@agenticmail/mcp	npm	< 0.9.27	0.9.27

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a missing authentication flaw in the optional HTTP transport of the @agenticmail/mcp package. When the server is started with the --http flag, it exposes a /mcp endpoint that, prior to the patch, had no authentication mechanism.

The root cause is located in packages/mcp/src/index.ts, specifically within the anonymous callback function passed to node:http.createServer. This function is the main entry point for all HTTP requests. Before the fix, it would accept and process any request to the /mcp endpoint without verifying the client's identity.

An attacker could send a JSON-RPC request to call the tools/call method. This request would be processed by the vulnerable request handler, which would then invoke the handleToolCall function. This downstream function is responsible for executing various tools, including highly privileged, "master-key-only" administrative functions such as setup_email_relay, setup_email_domain, and delete_agent. The MCP server would execute these tools using its own configured master key, effectively allowing an unauthenticated remote attacker to perform administrative actions.

The patch mitigates this vulnerability by introducing a mandatory bearer token authentication system. It adds a checkAuth function and invokes it at the very beginning of the createServer request handler. It also changes the default network binding from all interfaces to 127.0.0.1 to reduce the attack surface. If a valid token is not provided, the request is rejected with a 401 Unauthorized error, preventing access to the sensitive tool-handling functions.

Vulnerable functions

createServer.callback

packages/mcp/src/index.ts

This anonymous function is the main request handler for the MCP HTTP server, created using `node:http.createServer`. The vulnerability lies in the fact that, prior to the patch, this function did not perform any authentication or authorization checks. It directly processed incoming requests, allowing any unauthenticated client to access sensitive downstream functions. The patch introduces a mandatory bearer token check at the beginning of this handler, fixing the vulnerability.

handleToolCall

packages/mcp/src/tools.ts

This function acts as a dispatcher, taking a tool name and arguments and executing the corresponding tool. The vulnerability report confirms that sensitive, master-key-only tools like `setup_guide`, `setup_email_relay`, and `delete_agent` are dispatched through this function. Because of the missing authentication at the HTTP entry point, an attacker can craft a request that causes this function to execute privileged operations on their behalf.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.