https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T21:52:48.896558+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-327350 EUVD-2026-327350 2026-10-06T21:52:48.944088+00:00 EUVD-2026-327350 https://cve.radiocsirt.org/vuln/fkie_cve-2026-50287 fkie_cve-2026-50287 2026-10-06T21:52:48.944127+00:00

AgenticMail gives AI agents real email addresses and phone numbers. Prior to version 0.9.27, @agenticmail/mcp exposes a Streamable HTTP transport when started with --http or MCP_HTTP=1. In that mode, the /mcp endpoint accepts requests without any HTTP authentication layer. A remote client can initialize a session and call tools directly. This issue has been patched in version 0.9.27.

 https://cve.radiocsirt.org/vuln/ghsa-63gr-g7jc-v8rg GHSA-63gr-g7jc-v8rg — @agenticmail/mcp Missing Authentication for Critical Function 2026-10-06T21:52:48.944161+00:00

Affected: npm: @agenticmail/mcp

# AgenticMail MCP HTTP authorization bypass

## Summary

`@agenticmail/mcp` exposes a Streamable HTTP transport when started with `--http` or `MCP_HTTP=1`. In that mode, the `/mcp` endpoint accepts requests without any HTTP authentication layer. A remote client can initialize a session and call tools directly.

The problem is that the MCP server also exposes tools documented as requiring `AGENTICMAIL_MASTER_KEY`, and the server process forwards those calls using its own configured master key. As a result, any client that can reach the MCP HTTP port can invoke master-only operations without knowing the master key.

## Impact

An unauthenticated network client can invoke master-key-only MCP tools through the server, including administrative and gateway actions.

Confirmed with a read-only tool:

- `setup_guide`

The same path reaches higher-impact tools such as:

- `setup_email_relay` - `setup_email_domain` - `delete_agent` - `cleanup_agents` - `send_test_email`

## Affected Code

- `packages/mcp/src/index.ts` - `packages/mcp/src/tools.ts` - `packages/mcp/README.md`

Relevant observations:

- `packages/mcp/src/index.ts` starts an HTTP server for `/mcp` without checking an Authorization header. - `packages/mcp/src/tools.ts` marks gateway/admin tools as master-key tools and forwards them with the server-side `AGENTICMAIL_MASTER_KEY`. - `packages/mcp/README.md` documents that gateway/admin tools require the master key.

## Reproduction

Use the bundled one-command PoC runne…