{"action":"Upgrade @agenticmail/mcp to 0.9.27 or later.","affected":[{"fixed":"0.9.27","introduced":"0"}],"component":"@agenticmail/mcp","cve_ids":["CVE-2026-50287"],"ecosystem":"npm","epss":0.00359,"exploited":false,"fixed_versions":["0.9.27"],"ghsa_id":"GHSA-63gr-g7jc-v8rg","id":"tcs_01M5KF5B7ENTKEPQG5771YAK5K","modified_at":"2026-09-10T03:50:48.424843856Z","published_at":"2026-06-01T13:58:33Z","references":["https://osv.dev/vulnerability/GHSA-63gr-g7jc-v8rg","https://github.com/agenticmail/agenticmail/security/advisories/GHSA-63gr-g7jc-v8rg","https://nvd.nist.gov/vuln/detail/CVE-2026-50287","https://github.com/agenticmail/agenticmail/commit/7b9b05d973676e9f3d097c08b8e649f59bfc15d0","https://github.com/agenticmail/agenticmail/commit/7d1791da7c8c8bd4e70d7081db48e18ab55f6736","https://github.com/agenticmail/agenticmail","https://github.com/agenticmail/agenticmail/blob/7b9b05d973676e9f3d097c08b8e649f59bfc15d0/CHANGELOG.md?plain=1#L10","https://github.com/agenticmail/agenticmail/blob/7b9b05d973676e9f3d097c08b8e649f59bfc15d0/packages/mcp/README.md?plain=1#L13","https://github.com/agenticmail/agenticmail/blob/7b9b05d973676e9f3d097c08b8e649f59bfc15d0/packages/mcp/src/index.ts#L311"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GHSA-63gr-g7jc-v8rg","url":"https://osv.dev/vulnerability/GHSA-63gr-g7jc-v8rg"},{"source":"nvd","source_id":"CVE-2026-50287","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50287"}],"summary":"@agenticmail/mcp Missing Authentication for Critical Function"}