Cors Misconfiguration CVE-2026-33010

Requires mcp-memory-service versions before 10.25.1 with HTTP server enabled (MCP_HTTP_ENABLED=true) AND anonymous access enabled (MCP_ALLOW_ANONYMOUS_ACCESS=true). Remote attacker tricks victim into visiting malicious website that reads API responses cross-origin via overly permissive CORS configuration.

The CVSS score of 8.1 (High) reflects the network attack vector with low complexity, no privileges required, but user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). The UI:R metric is critical - an attacker must lure a victim with an active session to visit a malicious page. Real-world risk is elevated for deployments using the anonymous access configuration, which the advisory notes is the simplest setup method for the HTTP dashboard, suggesting it may be commonly deployed. The vulnerability is highly automatable once user interaction occurs, with straightforward exploitation requiring only JavaScript to issue cross-origin API calls. The combination of high confidentiality and integrity impact with zero authentication requirements in default configurations makes this a genuine priority for affected deployments, despite the absence of EPSS data or KEV listing. The availability of a GitHub security advisory and the clarity of the misconfiguration suggest exploit development is trivial for attackers familiar with CORS exploitation techniques.

An attacker hosts a malicious website and lures a user who has an active browser session with an mcp-memory-service instance configured with anonymous access. When the victim visits the attacker's site, embedded JavaScript automatically sends cross-origin API requests to the victim's mcp-memory-service endpoint, exploiting the permissive CORS policy to exfiltrate all stored memories, inject malicious data, or delete critical information without any visible indication to the victim. The attack requires minimal sophistication and can be automated to target multiple potential victim domains simultaneously.