Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
AgenticMail gives AI agents real email addresses and phone numbers. Prior to version 0.9.27, @agenticmail/mcp exposes a Streamable HTTP transport when started with --http or MCP_HTTP=1. In that mode, the /mcp endpoint accepts requests without any HTTP authentication layer. A remote client can initialize a session and call tools directly. This issue has been patched in version 0.9.27.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-50287 Unauthenticated Remote Tool Access in AgenticMail MCP HTTP Transport Below 0.9.27 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-50287
Post summary
The text announces CVE-2026-50287, noting it allows unauthenticated remote tool access in AgenticMail MCP HTTP Transport versions below 0.9.27, with no PoC, exploit, patch, or active exploitation claims.