p PatchFirst

PatchFirst · Latest vulnerabilities

@agenticmail/mcp vulnerabilities

Vulnerabilities published for @agenticmail/mcp in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. CVE-2026-50287

    High · CVSS 8.7EPSS 0.36%Fix available

    Missing Authentication for Critical Function in @agenticmail/mcp

    AgenticMail gives AI agents real email addresses and phone numbers. Prior to version 0.9.27, @agenticmail/mcp exposes a Streamable HTTP transport when started with --http or MCP_HTTP=1. In that mode, the /mcp endpoint accepts requests without any HTTP authentication layer. A remote client can initialize a session and call tools directly. This issue has been patched in version 0.9.27.

    @agenticmail/mcpNode.js
    • Update to 0.9.27
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →