Memmy Agent
Monthly
Token-less deployments of MemTensor's memmy-agent Memory Service expose POST /api/v1/admin/shutdown to unauthenticated remote requests, letting an attacker shut the service down and cause a low-impact denial of service. All versions up to 1.0.9, 1.1.1 and 1.2.2 are listed as affected (CPE: cpe:2.3:a:memtensor:memmy-agent:*), and the issue is rated only 2.3 under CVSS 4.0 (with our own assessment of 3.1/AV:N/AC:H/PR:N/UI:R/A:L) because exploitation is gated by a victim visiting an attacker-controlled page, by specific browser cross-origin behavior, and by the admin token being left unconfigured. Publicly available exploit code exists (the upstream GitHub issue and VulDB entry), but the practical risk is limited to internet-exposed instances running in the default, token-less state - the endpoint is designed for local use and the cross-origin behavior was reportedly tightened in later changes.
Token-less deployments of MemTensor's memmy-agent Memory Service expose POST /api/v1/admin/shutdown to unauthenticated remote requests, letting an attacker shut the service down and cause a low-impact denial of service. All versions up to 1.0.9, 1.1.1 and 1.2.2 are listed as affected (CPE: cpe:2.3:a:memtensor:memmy-agent:*), and the issue is rated only 2.3 under CVSS 4.0 (with our own assessment of 3.1/AV:N/AC:H/PR:N/UI:R/A:L) because exploitation is gated by a victim visiting an attacker-controlled page, by specific browser cross-origin behavior, and by the admin token being left unconfigured. Publicly available exploit code exists (the upstream GitHub issue and VulDB entry), but the practical risk is limited to internet-exposed instances running in the default, token-less state - the endpoint is designed for local use and the cross-origin behavior was reportedly tightened in later changes.