Vulnerability-Lookup

CVE-2026-49291 (GCVE-0-2026-49291)

Vulnerability from cvelistv5 – Published: 2026-06-19 17:59 – Updated: 2026-06-22 17:07

Title

mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call

Summary

mcp-memory-service is a semantic memory layer for AI applications. Prior to version 10.65.3, the HTTP MCP JSON-RPC endpoint at `/mcp` requires only OAuth `read` scope for all requests, then dispatches `tools/call` directly to handlers that include mutating tools. A read-only OAuth client can call `store_memory` and `delete_memory` through MCP even though the corresponding REST endpoints require `write` scope. Version 10.65.3 patches the issue.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M

References

3 references

URL	Tags
https://web.archive.org/web/20260508112116/https:…	x_refsource_CONFIRM
https://github.com/doobidoo/mcp-memory-service/se…	x_refsource_MISC
https://pypi.org/project/mcp-memory-service/10.65.3	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
doobidoo	mcp-memory-service	Affected: < 10.65.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49291",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-22T17:07:36.136160Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-22T17:07:55.536Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mcp-memory-service",
          "vendor": "doobidoo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 10.65.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "mcp-memory-service is a semantic memory layer for AI applications. Prior to version 10.65.3, the HTTP MCP JSON-RPC endpoint at `/mcp` requires only OAuth `read` scope for all requests, then dispatches `tools/call` directly to handlers that include mutating tools. A read-only OAuth client can call `store_memory` and `delete_memory` through MCP even though the corresponding REST endpoints require `write` scope. Version 10.65.3 patches the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-19T17:59:48.862Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://web.archive.org/web/20260508112116/https://github.com/doobidoo/mcp-memory-service/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://web.archive.org/web/20260508112116/https://github.com/doobidoo/mcp-memory-service/"
        },
        {
          "name": "https://github.com/doobidoo/mcp-memory-service/security/advisories/GHSA-2r68-g678-7qr3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/doobidoo/mcp-memory-service/security/advisories/GHSA-2r68-g678-7qr3"
        },
        {
          "name": "https://pypi.org/project/mcp-memory-service/10.65.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://pypi.org/project/mcp-memory-service/10.65.3"
        }
      ],
      "source": {
        "advisory": "GHSA-2r68-g678-7qr3",
        "discovery": "UNKNOWN"
      },
      "title": "mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49291",
    "datePublished": "2026-06-19T17:59:48.862Z",
    "dateReserved": "2026-05-28T20:07:58.862Z",
    "dateUpdated": "2026-06-22T17:07:55.536Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-49291",
      "date": "2026-07-01",
      "epss": "0.00264",
      "percentile": "0.17835"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-49291\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-06-19T19:16:36.170\",\"lastModified\":\"2026-06-23T15:59:21.443\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"mcp-memory-service is a semantic memory layer for AI applications. Prior to version 10.65.3, the HTTP MCP JSON-RPC endpoint at `/mcp` requires only OAuth `read` scope for all requests, then dispatches `tools/call` directly to handlers that include mutating tools. A read-only OAuth client can call `store_memory` and `delete_memory` through MCP even though the corresponding REST endpoints require `write` scope. Version 10.65.3 patches the issue.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"doobidoo\",\"product\":\"mcp-memory-service\",\"versions\":[{\"version\":\"\u003c 10.65.3\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-22T17:07:36.136160Z\",\"id\":\"CVE-2026-49291\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-862\"}]}],\"references\":[{\"url\":\"https://github.com/doobidoo/mcp-memory-service/security/advisories/GHSA-2r68-g678-7qr3\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://pypi.org/project/mcp-memory-service/10.65.3\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://web.archive.org/web/20260508112116/https://github.com/doobidoo/mcp-memory-service/\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-49291\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-22T17:07:36.136160Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-22T17:07:43.683Z\"}}], \"cna\": {\"title\": \"mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call\", \"source\": {\"advisory\": \"GHSA-2r68-g678-7qr3\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"doobidoo\", \"product\": \"mcp-memory-service\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 10.65.3\"}]}], \"references\": [{\"url\": \"https://web.archive.org/web/20260508112116/https://github.com/doobidoo/mcp-memory-service/\", \"name\": \"https://web.archive.org/web/20260508112116/https://github.com/doobidoo/mcp-memory-service/\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/doobidoo/mcp-memory-service/security/advisories/GHSA-2r68-g678-7qr3\", \"name\": \"https://github.com/doobidoo/mcp-memory-service/security/advisories/GHSA-2r68-g678-7qr3\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://pypi.org/project/mcp-memory-service/10.65.3\", \"name\": \"https://pypi.org/project/mcp-memory-service/10.65.3\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"mcp-memory-service is a semantic memory layer for AI applications. Prior to version 10.65.3, the HTTP MCP JSON-RPC endpoint at `/mcp` requires only OAuth `read` scope for all requests, then dispatches `tools/call` directly to handlers that include mutating tools. A read-only OAuth client can call `store_memory` and `delete_memory` through MCP even though the corresponding REST endpoints require `write` scope. Version 10.65.3 patches the issue.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-862\", \"description\": \"CWE-862: Missing Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-06-19T17:59:48.862Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-49291\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-22T17:07:55.536Z\", \"dateReserved\": \"2026-05-28T20:07:58.862Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-06-19T17:59:48.862Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-49291

Vulnerability from fkie_nvd - Published: 2026-06-19 19:16 - Updated: 2026-06-23 15:59

Severity

8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/doobidoo/mcp-memory-service/security/advisories/GHSA-2r68-g678-7qr3
	security-advisories@github.com	https://pypi.org/project/mcp-memory-service/10.65.3
	security-advisories@github.com	https://web.archive.org/web/20260508112116/https://github.com/doobidoo/mcp-memory-service/

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "mcp-memory-service",
          "vendor": "doobidoo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 10.65.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "mcp-memory-service is a semantic memory layer for AI applications. Prior to version 10.65.3, the HTTP MCP JSON-RPC endpoint at `/mcp` requires only OAuth `read` scope for all requests, then dispatches `tools/call` directly to handlers that include mutating tools. A read-only OAuth client can call `store_memory` and `delete_memory` through MCP even though the corresponding REST endpoints require `write` scope. Version 10.65.3 patches the issue."
    }
  ],
  "id": "CVE-2026-49291",
  "lastModified": "2026-06-23T15:59:21.443",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-49291",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-22T17:07:36.136160Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-19T19:16:36.170",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/doobidoo/mcp-memory-service/security/advisories/GHSA-2r68-g678-7qr3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://pypi.org/project/mcp-memory-service/10.65.3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://web.archive.org/web/20260508112116/https://github.com/doobidoo/mcp-memory-service/"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-2R68-G678-7QR3

Vulnerability from github – Published: 2026-06-26 21:04 – Updated: 2026-06-26 21:04

Summary

mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call

Details

Summary

The HTTP MCP JSON-RPC endpoint at /mcp requires only OAuth read scope for all requests, then dispatches tools/call directly to handlers that include mutating tools. A read-only OAuth client can call store_memory and delete_memory through MCP even though the corresponding REST endpoints require write scope.

Technical Details

src/mcp_memory_service/web/api/mcp.py declares mcp_endpoint with user: AuthenticationResult = Depends(require_read_access). For tools/call, it extracts the requested tool name and arguments, then calls handle_tool_call(storage, tool_name, arguments) without passing the authenticated user or checking a per-tool required scope.

The MCP tool registry includes both read tools and write tools. In the same handler file, store_memory creates a Memory object and calls storage.store(...), while delete_memory calls storage.delete(content_hash). These operations are reachable with only the read scope.

The REST endpoint demonstrates the intended boundary: POST /api/memories uses Depends(require_write_access) and rejects a read-only token with 403 insufficient_scope.

Reproduction

Enable OAuth and disable anonymous access.
Generate a valid OAuth JWT with only scope: read.
Confirm the REST write endpoint rejects it:

POST /api/memories
Authorization: Bearer <read-only-token>
Content-Type: application/json

{"content":"rest denied control"}

Expected and observed: HTTP 403 with Required scope 'write' not granted.

Send the same read-only token to the MCP endpoint:

POST /mcp
Authorization: Bearer <read-only-token>
Content-Type: application/json

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "store_memory",
    "arguments": {
      "content": "mcp read scope stored this",
      "tags": ["poc"]
    }
  }
}

Observed: HTTP 200 JSON-RPC success and the storage store sink is reached.

A read-only token can also call delete_memory through MCP if it knows a content hash:

POST /mcp
Authorization: Bearer <read-only-token>
Content-Type: application/json

{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/call",
  "params": {
    "name": "delete_memory",
    "arguments": {"content_hash": "<known_hash>"}
  }
}

Observed: HTTP 200 JSON-RPC success and the storage delete sink is reached.

Impact

A client intended to be read-only can inject or delete memories through the MCP API. This can corrupt the memory database, influence future agent context, and destroy stored user memories without the OAuth write scope required by the REST API.

Affected Versions

Confirmed present on current main commit c99a922477df41f75a44db11182ae48a57311910 and latest release tag v10.65.0 (4eb4a62665589f9dd9f8c393afa32de434b4098a).

Suggested Fix

Enforce authorization per MCP tool at tools/call time. Require write for store_memory and delete_memory, keep read only for read-only tools, and add regression tests proving direct tools/call to mutating tools is rejected before the handler reaches storage when the caller has only read scope.

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 10.65.1"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "mcp-memory-service"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.65.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-49291"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-26T21:04:38Z",
    "nvd_published_at": "2026-06-19T19:16:36Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe HTTP MCP JSON-RPC endpoint at `/mcp` requires only OAuth `read` scope for all requests, then dispatches `tools/call` directly to handlers that include mutating tools. A read-only OAuth client can call `store_memory` and `delete_memory` through MCP even though the corresponding REST endpoints require `write` scope.\n\n## Technical Details\n\n`src/mcp_memory_service/web/api/mcp.py` declares `mcp_endpoint` with `user: AuthenticationResult = Depends(require_read_access)`. For `tools/call`, it extracts the requested tool name and arguments, then calls `handle_tool_call(storage, tool_name, arguments)` without passing the authenticated user or checking a per-tool required scope.\n\nThe MCP tool registry includes both read tools and write tools. In the same handler file, `store_memory` creates a `Memory` object and calls `storage.store(...)`, while `delete_memory` calls `storage.delete(content_hash)`. These operations are reachable with only the `read` scope.\n\nThe REST endpoint demonstrates the intended boundary: `POST /api/memories` uses `Depends(require_write_access)` and rejects a read-only token with 403 `insufficient_scope`.\n\n## Reproduction\n\n1. Enable OAuth and disable anonymous access.\n2. Generate a valid OAuth JWT with only `scope: read`.\n3. Confirm the REST write endpoint rejects it:\n\n```http\nPOST /api/memories\nAuthorization: Bearer \u003cread-only-token\u003e\nContent-Type: application/json\n\n{\"content\":\"rest denied control\"}\n```\n\nExpected and observed: HTTP 403 with `Required scope \u0027write\u0027 not granted`.\n\n4. Send the same read-only token to the MCP endpoint:\n\n```http\nPOST /mcp\nAuthorization: Bearer \u003cread-only-token\u003e\nContent-Type: application/json\n\n{\n  \"jsonrpc\": \"2.0\",\n  \"id\": 1,\n  \"method\": \"tools/call\",\n  \"params\": {\n    \"name\": \"store_memory\",\n    \"arguments\": {\n      \"content\": \"mcp read scope stored this\",\n      \"tags\": [\"poc\"]\n    }\n  }\n}\n```\n\nObserved: HTTP 200 JSON-RPC success and the storage `store` sink is reached.\n\n5. A read-only token can also call `delete_memory` through MCP if it knows a content hash:\n\n```http\nPOST /mcp\nAuthorization: Bearer \u003cread-only-token\u003e\nContent-Type: application/json\n\n{\n  \"jsonrpc\": \"2.0\",\n  \"id\": 2,\n  \"method\": \"tools/call\",\n  \"params\": {\n    \"name\": \"delete_memory\",\n    \"arguments\": {\"content_hash\": \"\u003cknown_hash\u003e\"}\n  }\n}\n```\n\nObserved: HTTP 200 JSON-RPC success and the storage `delete` sink is reached.\n\n## Impact\n\nA client intended to be read-only can inject or delete memories through the MCP API. This can corrupt the memory database, influence future agent context, and destroy stored user memories without the OAuth `write` scope required by the REST API.\n\n## Affected Versions\n\nConfirmed present on current main commit `c99a922477df41f75a44db11182ae48a57311910` and latest release tag `v10.65.0` (`4eb4a62665589f9dd9f8c393afa32de434b4098a`).\n\n## Suggested Fix\n\nEnforce authorization per MCP tool at `tools/call` time. Require `write` for `store_memory` and `delete_memory`, keep `read` only for read-only tools, and add regression tests proving direct `tools/call` to mutating tools is rejected before the handler reaches storage when the caller has only `read` scope.",
  "id": "GHSA-2r68-g678-7qr3",
  "modified": "2026-06-26T21:04:38Z",
  "published": "2026-06-26T21:04:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/doobidoo/mcp-memory-service/security/advisories/GHSA-2r68-g678-7qr3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49291"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/doobidoo/mcp-memory-service"
    },
    {
      "type": "WEB",
      "url": "https://pypi.org/project/mcp-memory-service/10.65.3"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20260508112116/https://github.com/doobidoo/mcp-memory-service"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-49291 (GCVE-0-2026-49291)

FKIE_CVE-2026-49291

GHSA-2R68-G678-7QR3

Summary

Technical Details

Reproduction

Impact

Affected Versions

Suggested Fix

Tags

Sightings

Nomenclature