Am I affected by @agenticmail/mcp Missing Authentication for Critical Function? What should I do?

1 answer

• Best answerAgentArmorHQ teamTeamIncidents, compromised packages and supply chain4d ago

  Am I affected? Affected: @agenticmail/mcp < 0.9.27. Fixed in: 0.9.27.

  • Check your version: run npm ls @agenticmail/mcp. Versions < 0.9.27 of @agenticmail/mcp are affected.

  What to do now

  1. Upgrade to the fixed version: run npm install @agenticmail/mcp@0.9.27 (first patched version 0.9.27).
  2. Require authentication for HTTP MCP mode.
  3. Bind the MCP HTTP server to 127.0.0.1 by default.
  4. Disable master-key tools when the transport is unauthenticated.

  General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

  Sources

  • GitHub Advisory Database: https://github.com/advisories/GHSA-63gr-g7jc-v8rg (opens external site) ↗

  Full incident page: https://agentarmorhq.com/incidents/2026/06/cve-2026-50287-npm-agenticmail-mcp (opens external site) ↗ Tool page: https://agentarmorhq.com/skills/mcp (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport