Executive brief
AgenticMail is a tool used for managing email agents and relays. A security flaw in its Model Context Protocol (MCP) component allows anyone with network access to the server to perform administrative actions without a password. This could lead to unauthorized email sending, deletion of agents, or modification of email relay settings.
Technical details
The @agenticmail/mcp package fails to implement an authentication layer for its Streamable HTTP transport when enabled via the --http flag or MCP_HTTP=1 environment variable. The /mcp endpoint accepts JSON-RPC requests without verifying an Authorization header. Because the server process automatically attaches its own AGENTICMAIL_MASTER_KEY when forwarding tool calls to the backend API, unauthenticated clients can execute sensitive operations such as setup_email_relay, delete_agent, and send_test_email. This is a 'Missing Authentication for Critical Function' vulnerability (CWE-306). The issue is addressed in version 0.9.27.
Affected products
- AgenticMail @agenticmail/mcp < 0.9.27
Timeline
- 2026-05-29: disclosed
- 2026-05-29: advisory
- 2026-06-01: patched: Version 0.9.27 released
References
- https://github.com/agenticmail/agenticmail/security/advisories/GHSA-63gr-g7jc-v8rg
- https://github.com/agenticmail/agenticmail/commit/7b9b05d973676e9f3d097c08b8e649f59bfc15d0
- https://github.com/agenticmail/agenticmail/commit/7d1791da7c8c8bd4e70d7081db48e18ab55f6736
- https://github.com/agenticmail/agenticmail/blob/7b9b05d973676e9f3d097c08b8e649f59bfc15d0/CHANGELOG.md?plain=1
- https://github.com/agenticmail/agenticmail/blob/7b9b05d973676e9f3d097c08b8e649f59bfc15d0/packages/mcp/README.md?plain=1
- https://github.com/agenticmail/agenticmail/blob/7b9b05d973676e9f3d097c08b8e649f59bfc15d0/packages/mcp/src/index.ts