CVE-2026-44830
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Nocturne Memory to lekki serwer pamięci długoterminowej dla agentów MCP. W wersjach przed 2.4.1, gdy API_TOKEN jest nieustawiony lub pusty, BearerTokenAuthMiddleware omija uwierzytelnianie dla wszystkich żądań HTTP, co pozwala na nieautoryzowany dostęp do API.
Risk Assessment
Operatorzy, którzy korzystają z domyślnej konfiguracji, narażają się na możliwość odczytu, zapisu lub usunięcia wszystkich wpisów pamięci przez atakującego w tej samej sieci, co może prowadzić do poważnych naruszeń bezpieczeństwa.
Recommendation
Zaleca się aktualizację do wersji 2.4.1 lub nowszej oraz ustawienie API_TOKEN, aby zabezpieczyć dostęp do API przed nieautoryzowanym użyciem.
Related vulnerabilities
- CVE-2026-82533Critical
DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability in its local HTTP control-plane API that allows attackers to gain full agent control by supplying a spoofed Host header, as the server validates only the client-supplied Host header value rather than the actual TCP connection origin.
- CVE-2026-26084Critical
An improper access control vulnerability in Fortinet FortiSandbox versions 5.0.0 through 5.0.5, 4.4.0 through 4.4.8, Cloud 5.0.4 through 5.0.5, and PaaS 5.0.4 through 5.0.5 may allow an attacker to access sensitive information via crafted HTTP requests.
- CVE-2026-79576Critical
An issue in the Single-Sign On (SSO) component of Digital-Infrastructure v9.6.7 allows attackers to authenticate as any user, including the Admin, without a password.
- CVE-2026-61516Critical
Netis NX10 firmware versions V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a valid session.
- CVE-2026-12745Critical
A deserialization of untrusted data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.
- CVE-2026-12744Critical
A deserialization of untrusted data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.
- CVE-2026-12650Critical
A deserialization of untrusted data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
- CVE-2026-12647Critical
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
- CVE-2026-12646Critical
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
- CVE-2026-12645Critical
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
Original NVD description (English source)
Nocturne Memory is a lightweight, rollbackable, and visual Long-Term Memory Server for MCP Agents. Prior to 2.4.1, when API_TOKEN is unset or empty, the BearerTokenAuthMiddleware bypasses authentication for all HTTP requests. Combined with the default 0.0.0.0 host binding and CORS allow_origins=["*"], operators following the Docker setup without explicitly setting API_TOKEN expose the full Knowledge-Graph read/write API to any LAN-reachable client. An attacker on the same network can read, write, or delete all memory entries — including system://boot and core://* URIs that auto-load into downstream agent sessions, enabling persistent prompt-injection. This vulnerability is fixed in 2.4.1.