Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete Summary All HTTP routes under /api/documents/ in mcp-memory-service are served without any authentication dependency, even when the server is configured with an API key (MCPAPIKEY) or OAuth. An unauthenticated remote attacker can upload arbitrary content into the memory store (write), retrieve stored document content (read), and permanently delete memories belonging to authenticated users (delete) — all without supplying any credentials. The /api/memories counterpart correctly enforces authentication, making this an inconsistent and exploitable authentication boundary. CVSS 9.8 Critical. Details The documents.py router is instantiated without any router-level dependencies= parameter and the file does not import Depends at all, so no authentication guard is present on any of its routes: - src/mcpmemoryservice/web/api/documents.py:33 — from fastapi import APIRouter, UploadFile, File, Form,…
Recommended action: Upgrade to 10.67.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The HTTP MCP JSON-RPC endpoint at /mcp requires only OAuth read scope for all requests, then dispatches tools/call directly to handlers that include mutating tools. A read-only OAuth client can call storememory and deletememory through MCP even though the corresponding REST endpoints require write scope. Technical Details src/mcpmemoryservice/web/api/mcp.py declares mcpendpoint with user: AuthenticationResult = Depends(requirereadaccess). For tools/call, it extracts the requested tool name and arguments, then calls handletoolcall(storage, toolname, arguments) without passing the authenticated user or checking a per-tool required scope. The MCP tool registry includes both read tools and write tools. In the same handler file, storememory creates a Memory object and calls storage.store(...), while deletememory calls storage.delete(contenthash). These operations are reachable with only the read scope. The REST endpoint demonstrates the intended boundary: POST /api/memories uses…
Recommended action: Upgrade to 10.65.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When the HTTP server is enabled (MCPHTTPENABLED=true), the application configures FastAPI's CORSMiddleware with alloworigins=[''], allowcredentials=True, allowmethods=[""], and allowheaders=[""]. The wildcard Access-Control-Allow-Origin: header permits any website to read API responses cross-origin. When combined with anonymous access (MCPALLOWANONYMOUSACCESS=true) - the simplest way to get the HTTP dashboard working without OAuth - no credentials are needed, so any malicious website can silently read, modify, and delete all stored memories. Details Vulnerable Code config.py:546 - Wildcard CORS origin default This produces [''] by default, allowing any origin. app.py:274-280 - CORSMiddleware configuration How the Attack Works The wildcard CORS default means every API response includes Access-Control-Allow-Origin: . This tells browsers to allow any website to read the response. When combined with anonymous access (no authentication required), the attack is straightforward: The…
Recommended action: Upgrade to 10.25.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The /api/health/detailed endpoint returns detailed system information including OS version, Python version, CPU count, memory totals, disk usage, and the full database filesystem path. When MCPALLOWANONYMOUSACCESS=true is set (required for the HTTP server to function without OAuth/API key), this endpoint is accessible without authentication. Combined with the default 0.0.0.0 binding, this exposes sensitive reconnaissance data to the entire network. Details Vulnerable Code health.py:90-101 - System information collection health.py:131-132 - Database path disclosure Authentication Bypass Path The /api/health/detailed endpoint uses requirereadaccess which calls getcurrentuser. When MCPALLOWANONYMOUSACCESS=true, the auth middleware grants access: Note: The basic /health endpoint (line 68) has no auth dependency at all and returns version and uptime information unconditionally. Information Exposed | Field | Example Value | Reconnaissance Value |…
Recommended action: Upgrade to 10.21.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.