{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-15T19:53:16.982","vulnerabilities":[{"cve":{"id":"CVE-2026-50027","sourceIdentifier":"security-advisories@github.com","published":"2026-08-14T19:17:18.843","lastModified":"2026-08-14T19:17:18.843","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"mcp-memory-service is a semantic memory layer for AI applications. Prior to 10.67.1, all HTTP routes under /api/documents/* in mcp-memory-service are served without any authentication dependency, even when the server is configured with an API key (MCP_API_KEY) or OAuth. An unauthenticated remote attacker can upload arbitrary content into the memory store (write), retrieve stored document content (read), and permanently delete memories belonging to authenticated users (delete) — all without supplying any credentials. The /api/memories counterpart correctly enforces authentication, making this an inconsistent and exploitable authentication boundary. This vulnerability is fixed in 10.67.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"doobidoo","product":"mcp-memory-service","versions":[{"version":"< 10.67.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://github.com/advisories/GHSA-84hp-mqvj-3p8h","source":"security-advisories@github.com"},{"url":"https://pypi.org/project/mcp-memory-service","source":"security-advisories@github.com"},{"url":"https://web.archive.org/web/20260508112116/https://github.com/doobidoo/mcp-memory-service","source":"security-advisories@github.com"}]}}]}