CVE-2026-50027

Critical

Description

mcp-memory-service is a semantic memory layer for AI applications. Prior to 10.67.1, all HTTP routes under /api/documents/* in mcp-memory-service are served without any authentication dependency, even when the server is configured with an API key (MCP_API_KEY) or OAuth. An unauthenticated remote attacker can upload arbitrary content into the memory store (write), retrieve stored document content (read), and permanently delete memories belonging to authenticated users (delete) — all without supplying any credentials. The /api/memories counterpart correctly enforces authentication, making this an inconsistent and exploitable authentication boundary. This vulnerability is fixed in 10.67.1.

SeverityCritical

CVSS9.8

Exploit probability—

ProductMcp-memory-service

PublishedAug 14, 2026

First seenAug 14, 2026

Weakness typeCWE-306Missing authentication for critical function

How to fix

Update

mcp-memory-service10.67.1 or later

Affected products

Product	Affected versions	Fixed in
mcp-memory-servicePyPI	v < 10.67.1	10.67.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.