What is the CVSS score of EUVD-2026-38058?

EUVD-2026-38058 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of mcp-memory-service are affected by EUVD-2026-38058?

doobidoo mcp-memory-service contains an authorization flaw allowing read-only API credentials to invoke data-modifying operations, jeopardizing the integrity of memory systems that downstream AI…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-38058?

Yes, a public proof-of-concept exploit is available for EUVD-2026-38058. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate EUVD-2026-38058?

Within 24 hours: Identify all systems running doobidoo mcp-memory-service versions prior to 10.65.3; audit OAuth token scopes and /mcp endpoint access for read-only credentials. Within 7 days: Implement API gateway controls requiring write-scope validation for all /mcp mutating operations; rotate all read-only OAuth credentials and restrict their usage to read-only endpoints only. Within 30 days: Monitor vendor advisories for patch release targeting version 10.65.3 or later; execute immediate patching when available.

mcp-memory-service EUVD-2026-38058

| CVE-2026-49291 HIGH

Missing Authorization (CWE-862)

2026-06-19 GitHub_M

GHSA-2r68-g678-7qr3

Authentication Bypass Mcp Memory Service Doobidoo

8.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable HTTP endpoint, trivial JSON-RPC call (AC:L), requires a low-privileged read-scope OAuth token (PR:L), no user interaction; impact is write/delete of memories so I:H and A:H, no new confidentiality disclosure (C:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 19, 2026 - 21:02 EUVD

Analysis Generated

Jun 19, 2026 - 19:00 vuln.today

DescriptionCVE.org

mcp-memory-service is a semantic memory layer for AI applications. Prior to version 10.65.3, the HTTP MCP JSON-RPC endpoint at /mcp requires only OAuth read scope for all requests, then dispatches tools/call directly to handlers that include mutating tools. A read-only OAuth client can call store_memory and delete_memory through MCP even though the corresponding REST endpoints require write scope. Version 10.65.3 patches the issue.

AnalysisAI

Authorization bypass in doobidoo mcp-memory-service prior to 10.65.3 lets OAuth clients with only the read scope invoke mutating MCP tools such as store_memory and delete_memory via the /mcp JSON-RPC endpoint, despite the equivalent REST endpoints correctly enforcing the write scope. Authenticated read-only clients can therefore tamper with or destroy memory entries used by downstream AI applications. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

mcp-memory-service is a Python package (CPE cpe:2.3:a:doobidoo:mcp-memory-service) that provides a semantic memory layer for AI/LLM applications and exposes both a REST API and an MCP (Model Context Protocol) JSON-RPC interface. The MCP endpoint at /mcp gates every request behind a single OAuth scope check requiring only 'read', then dispatches the tools/call method directly to per-tool handlers without re-evaluating the scope appropriate to each tool. This is a textbook CWE-862 Missing Authorization defect: the scope-to-operation mapping enforced on REST routes was never mirrored on the MCP dispatcher, so write-class tools like store_memory and delete_memory inherit the relaxed read gate.

RemediationAI

Vendor-released patch: upgrade mcp-memory-service to 10.65.3 or later via pip (pip install --upgrade mcp-memory-service>=10.65.3), as confirmed by GHSA-2r68-g678-7qr3 and the PyPI release at https://pypi.org/project/mcp-memory-service/10.65.3. If immediate patching is not possible, compensating controls include disabling or network-blocking the /mcp JSON-RPC endpoint while continuing to use the REST API which already enforces write scope correctly, or issuing OAuth tokens only with the write scope to trusted clients and revoking any outstanding read-only tokens issued to untrusted agents (side effect: read-only integrations lose MCP access entirely until upgrade). Placing the service behind a reverse proxy that rejects MCP tools/call requests for store_memory and delete_memory is a finer-grained stopgap but requires JSON-RPC body inspection and will break legitimate write clients that use MCP.