CVE Record
[ CRITICAL ]CVE-2026-50027
Unauthenticated access to all document routes in mcp-memory-service
mcp-memory-service before 10.67.1 ignores configured auth on document routes, letting unauthenticated attackers read, write, or delete AI memory stores.
- Vendor
- mcp-memory-service
- Product
- mcp-memory-service (prior to 10.67.1)
- CVSS
- 9.8
- EPSS (exploit probability)
- 0.5%
- Status
- patched
- Published
All HTTP routes under /api/documents/ in mcp-memory-service are served without authentication regardless of whether MCP_API_KEY or OAuth is configured on the server. The auth middleware applies to other route groups but is simply absent from the document API. Unauthenticated attackers with network access can read stored documents, upload arbitrary content, and permanently delete memories.
Fixed in version 10.67.1. Update immediately for any internet-accessible deployment; firewall the service port if patching is delayed.
Source: GHSA-84hp-mqvj-3p8h
