CVE-2026-50027: mcp-memory-service Unauthenticated Read/Write/Delete via Missing Auth on /api/documents

Vulnerability Overview Vulnerability Name: : Document API endpoints lack authentication, allowing unauthorized memory read, write, and deletion CVE ID: CVE-2026-50027 CVSS Score: 9.8 (Critical) Severity: High Publication Date: 2025-05-28 Fixed Version: 10.67.1 Affected Versions: < 10.67.1 Description All endpoints under the route in lack authentication dependencies. Even if the service is configured with an API key ( ) or OAuth for authentication, unauthorized attackers can write arbitrary content to the memory store (write), retrieve stored document content (read), and permanently delete memories belonging to authenticated users (delete) without providing any credentials. The endpoint correctly implements authentication, making this vulnerability an inconsistent and exploitable authentication boundary issue. Impact Scope Confidentiality: An unauthorized attacker can read the content of recently uploaded documents via and enumerate upload IDs via . Stored memories may contain sensitive context such as personal notes, AI agent work logs, or proprietary data. Integrity: An unauthorized attacker can inject arbitrary data into the memory store by uploading documents, polluting the AI agent's knowledge base, and potentially leading to prompt injection attacks. Availability: An unauthorized attacker can delete all memories matching selected tags via or delete a single document via , resulting in permanent loss of stored data. Remediation In the file, add or dependencies to all affected endpoints. POC Code

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-50027: mcp-memory-service Unauthenticated Read/Write/Delete via Missing Auth on /api/documents

More from this source