{"id":"CVE-2026-50027","title":"mcp-memory-service is a semantic memory layer for AI applications","summary":"mcp-memory-service is a semantic memory layer for AI applications. Prior to 10.67.1, all HTTP routes under /api/documents/* in mcp-memory-service are served without any authentication dependency, even when the server is configured with a…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-306"],"vendor":"mcp-memory-service","product":"mcp-memory-service","affected":["mcp-memory-service < 10.67.1"],"patched":["mcp-memory-service 10.67.1"],"published":"2026-08-14","updated":"2026-09-16","sourceUpdated":"2026-09-16T13:42:43.447","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-50027","references":[{"url":"https://github.com/advisories/GHSA-84hp-mqvj-3p8h","label":"security-advisories@github.com"},{"url":"https://pypi.org/project/mcp-memory-service","label":"security-advisories@github.com"},{"url":"https://web.archive.org/web/20260508112116/https://github.com/doobidoo/mcp-memory-service","label":"security-advisories@github.com"},{"url":"https://github.com/doobidoo/mcp-memory-service/security/advisories/GHSA-84hp-mqvj-3p8h"}],"tags":["nvd","ghsa","pip"],"epss":0.00959,"epssPercentile":0.59822,"ecosystem":"pip","ingestedAt":"2026-07-02T15:38:25.163Z","slug":"CVE-2026-50027","body":"## Overview\n\nmcp-memory-service is a semantic memory layer for AI applications. Prior to 10.67.1, all HTTP routes under /api/documents/* in mcp-memory-service are served without any authentication dependency, even when the server is configured with an API key (MCP_API_KEY) or OAuth. An unauthenticated remote attacker can upload arbitrary content into the memory store (write), retrieve stored document content (read), and permanently delete memories belonging to authenticated users (delete) — all without supplying any credentials. The /api/memories counterpart correctly enforces authentication, making this an inconsistent and exploitable authentication boundary. This vulnerability is fixed in 10.67.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-50027)\n\nAffected packages:\n\n- `mcp-memory-service < 10.67.1`\n\nPatched in:\n\n- `mcp-memory-service 10.67.1`\n\nSource: https://github.com/advisories/GHSA-84hp-mqvj-3p8h","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}