CVE-2026-50287: Missing Authentication for Critical Function in @agenticmail/mcp

Synopsis

Missing authentication for a critical function in @agenticmail/mcp allows any remote client to interact with the exposed /mcp endpoint without credentials. The service is reachable over the network and requires no authentication, login, or prior session, as reflected in the CVSS v4.0 vector (AV:N, PR:N, UI:N). Successful exploitation gives an attacker full read access to data handled by the AI agent, including email addresses, phone numbers, and any content processed through the MCP tool interface. A patched-image rebuild at version 0.9.27 is available on HarborGuard for environments running an affected version of this package.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The /mcp endpoint is exposed over HTTP, so the attacker must be able to reach the service across the network.

• AuthenticationNot required

  No HTTP authentication layer is present; any remote client can initialize a session and call tools without credentials.

• Victim interactionNot required

  The attacker interacts directly with the endpoint and does not need any action from a user or operator to complete the attack.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions or environmental dependencies required.

Blast Radius

• Reads emails, phone numbers, and any content processed through the MCP tool interface belonging to AI agent sessions.
• Initializes arbitrary sessions and invokes MCP tools directly, bypassing any application-layer access controls built on top of the unauthenticated endpoint.
• Exposes sensitive data managed by AI agents, including messages and contact identifiers, to any network-reachable client.