CVE-2026-50027

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-50027", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-02T22:46:02.580Z", "datePublished": "2026-08-14T18:52:47.309Z", "dateUpdated": "2026-08-17T16:08:00.980Z"}, "containers": {"cna": {"title": "mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete", "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "lang": "en", "description": "CWE-306: Missing Authentication for Critical Function", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://web.archive.org/web/20260508112116/https://github.com/doobidoo/mcp-memory-service", "tags": ["x_refsource_CONFIRM"], "url": "https://web.archive.org/web/20260508112116/https://github.com/doobidoo/mcp-memory-service"}, {"name": "https://github.com/advisories/GHSA-84hp-mqvj-3p8h", "tags": ["x_refsource_MISC"], "url": "https://github.com/advisories/GHSA-84hp-mqvj-3p8h"}, {"name": "https://pypi.org/project/mcp-memory-service", "tags": ["x_refsource_MISC"], "url": "https://pypi.org/project/mcp-memory-service"}], "affected": [{"vendor": "doobidoo", "product": "mcp-memory-service", "versions": [{"version": "< 10.67.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-14T18:52:47.309Z"}, "descriptions": [{"lang": "en", "value": "mcp-memory-service is a semantic memory layer for AI applications. Prior to 10.67.1, all HTTP routes under /api/documents/* in mcp-memory-service are served without any authentication dependency, even when the server is configured with an API key (MCP_API_KEY) or OAuth. An unauthenticated remote attacker can upload arbitrary content into the memory store (write), retrieve stored document content (read), and permanently delete memories belonging to authenticated users (delete) \u2014 all without supplying any credentials. The /api/memories counterpart correctly enforces authentication, making this an inconsistent and exploitable authentication boundary. This vulnerability is fixed in 10.67.1."}], "source": {"advisory": "GHSA-84hp-mqvj-3p8h", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-17T15:24:28.617436Z", "id": "CVE-2026-50027", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-17T16:08:00.980Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-50027", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-17T15:24:28.617436Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-17T15:24:30.363Z"}}], "cna": {"title": "mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete", "source": {"advisory": "GHSA-84hp-mqvj-3p8h", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "doobidoo", "product": "mcp-memory-service", "versions": [{"status": "affected", "version": "< 10.67.1"}]}], "references": [{"url": "https://web.archive.org/web/20260508112116/https://github.com/doobidoo/mcp-memory-service", "name": "https://web.archive.org/web/20260508112116/https://github.com/doobidoo/mcp-memory-service", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/advisories/GHSA-84hp-mqvj-3p8h", "name": "https://github.com/advisories/GHSA-84hp-mqvj-3p8h", "tags": ["x_refsource_MISC"]}, {"url": "https://pypi.org/project/mcp-memory-service", "name": "https://pypi.org/project/mcp-memory-service", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "mcp-memory-service is a semantic memory layer for AI applications. Prior to 10.67.1, all HTTP routes under /api/documents/* in mcp-memory-service are served without any authentication dependency, even when the server is configured with an API key (MCP_API_KEY) or OAuth. An unauthenticated remote attacker can upload arbitrary content into the memory store (write), retrieve stored document content (read), and permanently delete memories belonging to authenticated users (delete) \u2014 all without supplying any credentials. The /api/memories counterpart correctly enforces authentication, making this an inconsistent and exploitable authentication boundary. This vulnerability is fixed in 10.67.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-14T18:52:47.309Z"}}}, "cveMetadata": {"cveId": "CVE-2026-50027", "state": "PUBLISHED", "dateUpdated": "2026-08-17T16:08:00.980Z", "dateReserved": "2026-06-02T22:46:02.580Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-14T18:52:47.309Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mcp-memory-service", "vendor": "doobidoo", "versions": [{"status": "affected", "version": "< 10.67.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "mcp-memory-service is a semantic memory layer for AI applications. Prior to 10.67.1, all HTTP routes under /api/documents/* in mcp-memory-service are served without any authentication dependency, even when the server is configured with an API key (MCP_API_KEY) or OAuth. An unauthenticated remote attacker can upload arbitrary content into the memory store (write), retrieve stored document content (read), and permanently delete memories belonging to authenticated users (delete) \u2014 all without supplying any credentials. The /api/memories counterpart correctly enforces authentication, making this an inconsistent and exploitable authentication boundary. This vulnerability is fixed in 10.67.1."}], "id": "CVE-2026-50027", "lastModified": "2026-09-16T13:42:43.447", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50027", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-17T15:24:28.617436Z", "version": "2.0.3"}}]}, "published": "2026-08-14T19:17:18.843", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/advisories/GHSA-84hp-mqvj-3p8h"}, {"source": "security-advisories@github.com", "url": "https://pypi.org/project/mcp-memory-service"}, {"source": "security-advisories@github.com", "url": "https://web.archive.org/web/20260508112116/https://github.com/doobidoo/mcp-memory-service"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,10.67.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "mcp-memory-service", "source": "cna", "vendor": "doobidoo"}, "product": "mcp-memory-service", "vendor": "doobidoo"}], "created": "2026-08-14T20:45:03.154402+00:00", "updated": "2026-08-14T20:45:03.250605+00:00", "vendors": ["doobidoo", "doobidoo$PRODUCT$mcp-memory-service"]}