CVE-2026-50027
CriticalCVSS 9.8Summary
mcp-memory-service before version 10.67.1 serves all HTTP routes under /api/documents/* without any authentication dependency, even when configured with an API key or OAuth. An unauthenticated attacker can upload, retrieve, and permanently delete data from the memory store.
Risk Assessment
An unauthenticated attacker can access, modify, or delete sensitive data, compromising data confidentiality and integrity.
Recommendation
Update mcp-memory-service to version 10.67.1 or later, which enforces authentication for all routes.
Original NVD description (English source)
mcp-memory-service is a semantic memory layer for AI applications. Prior to 10.67.1, all HTTP routes under /api/documents/* in mcp-memory-service are served without any authentication dependency, even when the server is configured with an API key (MCP_API_KEY) or OAuth. An unauthenticated remote attacker can upload arbitrary content into the memory store (write), retrieve stored document content (read), and permanently delete memories belonging to authenticated users (delete) — all without supplying any credentials. The /api/memories counterpart correctly enforces authentication, making this an inconsistent and exploitable authentication boundary. This vulnerability is fixed in 10.67.1.