CVE-2026-50287

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-50287
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50287.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-50287
Aliases
Published
2026-06-12T18:44:48.313Z
Modified
2026-08-12T03:51:43.053907236Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Missing Authentication for Critical Function in @agenticmail/mcp
Details

AgenticMail gives AI agents real email addresses and phone numbers. Prior to version 0.9.27, @agenticmail/mcp exposes a Streamable HTTP transport when started with --http or MCP_HTTP=1. In that mode, the /mcp endpoint accepts requests without any HTTP authentication layer. A remote client can initialize a session and call tools directly. This issue has been patched in version 0.9.27.

Database specific 
{
    "cwe_ids": [
        "CWE-306"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50287.json"
}
References

Affected packages

Git / github.com/agenticmail/agenticmail

Affected ranges

Type
GIT
Repo
https://github.com/agenticmail/agenticmail
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c89156a63ba4260793624a6516ceef65edce12b0
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.9.27"
        }
    ]
}

Affected versions

plugin-v0.*
plugin-v0.8.10
v0.*
v0.3.25
v0.4.0
v0.5.34
v0.5.37
v0.5.38
v0.5.39
v0.5.40
v0.5.41
v0.5.42
v0.5.43
v0.5.44
v0.5.50
v0.5.51
v0.5.52
v0.5.53
v0.5.54
v0.5.55
v0.5.56
v0.5.57
v0.5.58
v0.5.59
v0.5.60
v0.5.61
v0.5.62
v0.8.10
v0.8.11
v0.8.12
v0.8.13
v0.8.14
v0.8.15
v0.8.16
v0.8.18
v0.8.19
v0.8.2
v0.8.21
v0.8.22
v0.8.23
v0.8.24
v0.8.25
v0.8.26
v0.8.27
v0.8.28
v0.8.29
v0.8.3
v0.8.30
v0.8.31
v0.8.32
v0.8.33
v0.8.34
v0.8.35
v0.8.36
v0.8.4
v0.8.5
v0.8.6
v0.8.7
v0.8.8
v0.8.9
v0.9.0
v0.9.1
v0.9.10
v0.9.11
v0.9.12
v0.9.13
v0.9.14
v0.9.15
v0.9.16
v0.9.17
v0.9.18
v0.9.19
v0.9.2
v0.9.20
v0.9.21
v0.9.22
v0.9.23
v0.9.24
v0.9.25
v0.9.26
v0.9.3
v0.9.4
v0.9.5
v0.9.6
v0.9.7
v0.9.8
v0.9.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50287.json"