Unauth Access to AI Memory: CVE-2026-50027 Patched

The semantic memory layer mcp-memory-service shipped CVE-2026-50027: every HTTP route under /api/documents/ is accessible without credentials. That’s not a misconfiguration — it’s the default. Even deployments explicitly configured with MCP_API_KEY or OAuth let anyone read, write, or delete stored documents without authentication. CVSS: 9.8 Critical. Fixed in 10.67.1.

What’s exposed

mcp-memory-service is a semantic memory layer for AI applications — it stores documents that agents and LLM applications retrieve as context. What’s sitting in those stores varies by deployment: conversation history, user data, internal knowledge bases, whatever the application fed it.

Unauthenticated attackers with network access can:

• Read any stored document by ID
• Write arbitrary content into the memory store, poisoning what agents retrieve as context
• Delete any stored memory, permanently

The /api/documents/ routes skip the server’s authentication middleware entirely. MCP_API_KEY and any OAuth configuration apply to other route groups; the document API simply doesn’t check. GHSA-84hp-mqvj-3p8h documents this as the root cause.

Action items

Update to 10.67.1. That’s the fix — the patch gates all /api/documents/ routes through the server’s existing authentication middleware. No configuration changes needed after the update.

If you can’t patch immediately:

• Firewall the service port. mcp-memory-service shouldn’t be internet-accessible regardless; if it is, that’s a separate problem worth fixing at the same time.
• After patching, audit stored documents for unexpected or injected content before relying on the store again.

Priority call

Network-accessible deployments: patch or firewall today. Unauthenticated write access to an AI context store is a direct path to corrupting what your agents retrieve and act on — MCP server vulnerabilities have been actively mapped by researchers since mid-year, and this attack surface is not theoretical.

Internal-only deployments sitting behind a hard network boundary can roll the update on their normal patch cadence — this week, not next month.