Description

mcp-memory-service is a semantic memory layer for AI applications. Prior to 10.67.1, all HTTP routes under /api/documents/* in mcp-memory-service are served without any authentication dependency, even when the server is configured with an API key (MCP_API_KEY) or OAuth. An unauthenticated remote attacker can upload arbitrary content into the memory store (write), retrieve stored document content (read), and permanently delete memories belonging to authenticated users (delete) — all without supplying any credentials. The /api/memories counterpart correctly enforces authentication, making this an inconsistent and exploitable authentication boundary. This vulnerability is fixed in 10.67.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-14T19:17:18.843Z",
  "pubdate": "2026-08-14T19:17:18.843Z",
  "executiveSummary": "An authentication bypass vulnerability exists in mcp-memory-service prior to version 10.67.1, specifically affecting all HTTP routes under the /api/documents/* endpoint path. Despite the server being configured with security mechanisms such as an API key (MCP_API_KEY) or OAuth, these specific document routes are served entirely without any authentication dependency. This contrasts with the securely enforced counterpart routes under /api/memories, creating a critical and exploitable inconsistent authentication boundary.\nThe flaw grants unauthenticated remote attackers the capability to interact with the memory store with complete impunity. Attackers can upload arbitrary content, read stored document data, and permanently delete memories belonging to legitimate authenticated users without supplying any credentials whatsoever. The risk implications are severe, leading to potential data integrity violations, unauthorized data disclosure, and denial of service via data destruction.\nNo complex exploitation requirements or prior access are needed; the attack can be executed over the network by any unauthenticated remote entity capable of issuing HTTP requests to the exposed API routes.",
  "technicalDetails": "The root cause of the vulnerability is an inconsistent implementation of access control boundaries across API route handlers within the mcp-memory-service application. While the /api/memories endpoint group properly integrates authentication dependencies to validate credentials such as MCP_API_KEY or OAuth tokens, the /api/documents/* route handlers fail to invoke these security checks. Consequently, the underlying web framework routes incoming HTTP requests directly to the document controller logic without verifying the identity or authorization status of the requester.\nThe vulnerable component consists of the HTTP routing and middleware layer governing the /api/documents/* endpoints in versions prior to 10.67.1. Network exposure is broad, affecting any deployment where these HTTP routes are accessible to untrusted networks or the public internet.\nThe attack flow proceeds as follows: An unauthenticated remote attacker crafts standard HTTP requests targeting the unprotected /api/documents/* routes. Because no authentication dependency is enforced by the server, the attacker can execute multiple operations. For write operations, the attacker submits arbitrary content payloads via HTTP POST or PUT requests to inject unverified data directly into the memory store. For read operations, the attacker issues HTTP GET requests to retrieve sensitive stored document content belonging to other users. For delete operations, the attacker sends HTTP DELETE requests to permanently purge memories from the system.\nPost-exploitation impact includes unauthorized data tampering, exposure of sensitive semantic memory data to malicious actors, and irreversible deletion of critical application data, resulting in a severe impact on the confidentiality, integrity, and availability of the AI application's memory layer."
}