EUVD-2026-38058
GHSA-2r68-g678-7qr3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain read-scope OAuth token
-
DeliveryReach /mcp JSON-RPC endpoint over network
-
ExploitSend tools/call for delete_memory or store_memory
-
ExecutionScope check passes on read only
-
PersistHandler executes mutating operation
-
ImpactMemory store tampered or wiped
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid OAuth access token bearing the read scope for the target mcp-memory-service instance and network reachability to the HTTP /mcp JSON-RPC endpoint; the instance must be running a vulnerable version prior to 10.65.3 with the MCP HTTP interface enabled (it is the affected code path, distinct from the REST API). No user interaction and no write/admin scope are needed, and exploitation works against default configurations of the HTTP MCP endpoint. Limiting factors: deployments that never issue read-only tokens, that disable the HTTP MCP endpoint, or that front it with an external authorization proxy are not exposed. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H (8.1 High) accurately reflects a network-reachable, low-complexity bypass that requires a low-privileged OAuth token and yields high integrity and availability impact with no confidentiality loss - consistent with an attacker overwriting or deleting memories but not reading new data they could not already access. There is no CISA KEV entry, no public POC referenced, and no EPSS figure supplied, so real-world exploitation pressure appears low at present; however the prerequisite is modest (any issued read-scope token), so any deployment that hands out read tokens to semi-trusted agents or integrations is materially exposed. Defenders should treat this as a real priority for any multi-tenant or agent-shared deployment, and a lower priority for single-user local installs where only the operator holds tokens. |
| Exploit ScenarioDerived | An attacker who has obtained or been legitimately issued an OAuth token with only the read scope - for example a third-party AI agent integration meant to query memories - sends a JSON-RPC tools/call request to /mcp invoking delete_memory or store_memory with attacker-chosen content. Because the endpoint only verifies the read scope, the call succeeds and the attacker can wipe stored memories or poison them with adversarial content that downstream LLM consumers will later retrieve. No public POC is referenced, but the bypass is trivial to reproduce given the description. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 19, 2026
Authorization bypass in doobidoo mcp-memory-service prior to 10.65.3 lets OAuth clients with only the read scope invoke mutating MCP tools such as store_memory and delete_memory via the /mcp JSON-RPC endpoint, despite the equivalent REST endpoints correctly enforcing the write scope. Authenticated read-only clients can therefore tamper with or destroy memory entries used by downstream AI applications. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
Vendor-released patch: upgrade mcp-memory-service to 10.65.3 or later via pip (pip install --upgrade mcp-memory-service>=10.65.3), as confirmed by GHSA-2r68-g678-7qr3 and the PyPI release at https://pypi.org/project/mcp-memory-service/10.65.3. If immediate patching is not possible, compensating controls include disabling or network-blocking the /mcp JSON-RPC endpoint while continuing to use the REST API which already enforces write scope correctly, or issuing OAuth tokens only with the write scope to trusted clients and revoking any outstanding read-only tokens issued to untrusted agents (side effect: read-only integrations lose MCP access entirely until upgrade). Placing the service behind a reverse proxy that rejects MCP tools/call requests for store_memory and delete_memory is a finer-grained stopgap but requires JSON-RPC body inspection and will break legitimate write clients that use MCP.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
mcp-memory-service is a Python package (CPE cpe:2.3:a:doobidoo:mcp-memory-service) that provides a semantic memory layer for AI/LLM applications and exposes both a REST API and an MCP (Model Context Protocol) JSON-RPC interface. The MCP endpoint at /mcp gates every request behind a single OAuth scope check requiring only 'read', then dispatches the tools/call method directly to per-tool handlers without re-evaluating the scope appropriate to each tool. This is a textbook CWE-862 Missing Authorization defect: the scope-to-operation mapping enforced on REST routes was never mirrored on the MCP dispatcher, so write-class tools like store_memory and delete_memory inherit the relaxed read gate.
Know when Mcp Memory Service gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Network-reachable HTTP endpoint, trivial JSON-RPC call (AC:L), requires a low-privileged read-scope OAuth token (PR:L), no user interaction; impact is write/delete of memories so I:H and A:H, no new confidentiality disclosure (C:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
mcp-memory-service is a semantic memory layer for AI applications. Prior to version 10.65.3, the HTTP MCP JSON-RPC endpoint at /mcp requires only OAuth read scope for all requests, then dispatches tools/call directly to handlers that include mutating tools. A read-only OAuth client can call store_memory and delete_memory through MCP even though the corresponding REST endpoints require write scope. Version 10.65.3 patches the issue.
Executive ViewAI
doobidoo mcp-memory-service contains an authorization flaw allowing read-only API credentials to invoke data-modifying operations, jeopardizing the integrity of memory systems that downstream AI applications depend on. This affects any organization using the service for AI application memory management, creating immediate exposure to unauthorized data tampering and destruction. No vendor patch is currently available to resolve the vulnerability.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Enforce write-scope validation at API gateway or proxy layer for all /mcp JSON-RPC mutating operations; (2) Restrict read-only OAuth token credentials to read-only REST endpoints only, blocking /mcp access; (3) Enable comprehensive audit logging on all memory mutation operations to detect unauthorized access; (4) Network-segment memory service from internet-facing and untrusted networks where feasible; (5) Immediately rotate all read-scope OAuth credentials assigned to external or integrated applications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Mcp Memory Service
View allThe /api/health/detailed endpoint in mcp-memory-service prior to version 10.21.0 discloses sensitive system information
A CORS misconfiguration vulnerability in mcp-memory-service allows any malicious website to perform cross-origin request
Exploit-DB