Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-50027: mcp-memory-service: Unauthenticated Access to Document API Endpoints
CVE-2026-50027 · published 20 days ago
Summary
An attacker can upload, read, or delete sensitive data without a password. This is a security risk because it allows unauthorized access to user memories. To fix this, update the mcp-memory-service to require authentication for all document API endpoints.
What to do
- Update mcp-memory-service to version 10.67.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | – | mcp-memory-service |
< 10.67.1 Fix: upgrade to 10.67.1
|
| – | doobidoo | mcp-memory-service | < 10.67.1 |
Original advisory text
mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete
mcp-memory-service is a semantic memory layer for AI applications. Prior to 10.67.1, all HTTP routes under /api/documents/* in mcp-memory-service are served without any authentication dependency, even when the server is configured with an API key (MCP_API_KEY) or OAuth. An unauthenticated remote attacker can upload arbitrary content into the memory store (write), retrieve stored document content (read), and permanently delete memories belonging to authenticated users (delete) — all without supplying any credentials. The /api/memories counterpart correctly enforces authentication, making this an inconsistent and exploitable authentication boundary. This vulnerability is fixed in 10.67.1.
References
Severity
9.8
Critical
CVSS 3.1: 9.8 (GHSA)
Exploitation
EPSS <1%
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published14 Aug 2026
Updated3 Sep 2026
First seen2 Jul 2026
Monitor software like this
Free during beta