CVE-2026-50287: AgenticMail Authentication Bypass Flaw

CVE-2026-50287 Overview

CVE-2026-50287 affects AgenticMail, a service that provides AI agents with real email addresses and phone numbers. The @agenticmail/mcp package exposes a Streamable HTTP transport when launched with the --http flag or MCP_HTTP=1 environment variable. In this mode, the /mcp endpoint accepts requests without any HTTP authentication layer. A remote unauthenticated client can initialize a Model Context Protocol (MCP) session and invoke tools directly, gaining access to AI agent capabilities including email and SMS functionality. The flaw is classified as [CWE-306] Missing Authentication for Critical Function. Version 0.9.27 contains the fix.

Critical Impact
Remote unauthenticated attackers can invoke MCP tools on exposed AgenticMail instances, sending email and SMS messages on behalf of the agent owner.

Affected Products

@agenticmail/mcp versions prior to 0.9.27
AgenticMail deployments running with --http flag
AgenticMail deployments with MCP_HTTP=1 environment variable set

Discovery Timeline

2026-06-12 - CVE-2026-50287 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-50287

Vulnerability Analysis

The vulnerability resides in the Streamable HTTP transport mode of @agenticmail/mcp. When operators enable this mode, the server binds an /mcp endpoint that processes MCP JSON-RPC requests. The implementation omits any authentication middleware between the network listener and the request handler. Any client able to reach the listening socket can establish an MCP session and call registered tools.

AgenticMail provisions real email addresses and phone numbers to AI agents. Tools exposed through MCP therefore control message dispatch, inbox access, and contact information tied to the operator's account. An attacker with network reach to the endpoint can read messages, send fraudulent emails, or initiate SMS traffic.

Root Cause

The root cause is Missing Authentication for a Critical Function [CWE-306]. The HTTP transport added a new attack surface without inheriting the authentication controls present on other transports such as stdio. The /mcp route accepts session initialization and tool invocation requests with no bearer token, API key, or mTLS verification.

Attack Vector

Exploitation requires network access to the host running @agenticmail/mcp in HTTP mode. The attacker sends a standard MCP initialize request to the /mcp endpoint, receives a session identifier, then issues tools/list and tools/call requests. No credentials, prior session, or user interaction are required. Hosts exposed to the public internet, or reachable from compromised internal hosts, are at immediate risk. Refer to the GitHub Security Advisory for protocol-level details.

Detection Methods for CVE-2026-50287

Indicators of Compromise

Inbound HTTP requests to /mcp from unexpected source addresses
MCP initialize and tools/call requests without an Authorization header
Process arguments containing --http or environment variable MCP_HTTP=1 on @agenticmail/mcp hosts
Outbound email or SMS activity not correlated with legitimate agent workflows

Detection Strategies

Inventory all hosts running @agenticmail/mcp and identify those started with HTTP transport enabled
Inspect reverse proxy and load balancer logs for requests to /mcp paths from untrusted networks
Audit AgenticMail account activity logs for tool invocations that lack a corresponding authenticated user session
Compare installed package versions against 0.9.27 using npm ls @agenticmail/mcp

Monitoring Recommendations

Alert on any TCP listener bound to the MCP HTTP port that is reachable from non-loopback interfaces
Track sudden spikes in outbound mail or SMS volume tied to AgenticMail agents
Capture HTTP request logs for the /mcp endpoint and forward to a centralized log store for correlation

How to Mitigate CVE-2026-50287

Immediate Actions Required

Upgrade @agenticmail/mcp to version 0.9.27 or later on all hosts
Remove the --http flag or unset MCP_HTTP=1 until the upgrade completes if HTTP transport is not required
Restrict network access to the MCP listener using host firewalls or security groups to trusted sources only
Rotate any credentials, API keys, or contact records that may have been accessed through the exposed endpoint

Patch Information

The maintainers patched the issue in @agenticmail/mcp version 0.9.27. Update with npm install @agenticmail/mcp@0.9.27 or the equivalent command for your package manager. Review the GitHub Security Advisory GHSA-63gr-g7jc-v8rg for full release notes.

Workarounds

Run @agenticmail/mcp exclusively with the stdio transport, omitting the --http flag and MCP_HTTP variable
Place the MCP HTTP listener behind a reverse proxy that enforces authentication and TLS client verification
Bind the listener to 127.0.0.1 and tunnel access through SSH or a zero-trust gateway

bash

# Upgrade to the patched release
npm install @agenticmail/mcp@0.9.27

# Verify installed version
npm ls @agenticmail/mcp

# Start without HTTP transport (recommended)
unset MCP_HTTP
npx @agenticmail/mcp