CVE-2026-29787: 
Python vulnerability analysis and mitigation

CVE-2026-29787 is an information disclosure vulnerability in mcp-memory-service, an open-source memory backend for multi-agent systems. The /api/health/detailed HTTP endpoint exposes sensitive system reconnaissance data — including OS version, Python version, CPU count, memory totals, disk usage, and the full database filesystem path — to unauthenticated network attackers when MCP_ALLOW_ANONYMOUS_ACCESS=true is configured. All versions prior to 10.21.0 of the mcp-memory-service pip package are affected. The vulnerability was published on March 5, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The /api/health/detailed endpoint in health.py collects and returns detailed system information via Python's platform and psutil libraries, including the full database filesystem path via storage.db_path. The authentication middleware in middleware.py grants anonymous read access when MCP_ALLOW_ANONYMOUS_ACCESS=true, bypassing the require_read_access dependency entirely. Compounding the issue, the service binds to 0.0.0.0 by default, making the endpoint reachable from any host on the network without credentials. The GitHub Security Advisory includes a proof-of-concept demonstrating the data exposed (Github Advisory).

Successful exploitation allows an unauthenticated attacker to perform detailed system fingerprinting, including identifying the exact OS and kernel version (enabling targeted CVE selection), the Python runtime version, hardware resource profile, and the full filesystem path to the database file — which also reveals the system username and home directory structure. While there is no direct code execution or data modification impact, the disclosed information significantly reduces attacker effort for follow-on attacks, including targeting known OS/Python CVEs or directly accessing the database file if other vulnerabilities are present (Github Advisory).

A proof-of-concept is publicly documented in the GitHub Security Advisory, describing concrete attack steps: scan for port 8000, issue an unauthenticated GET /api/health/detailed request, and receive the sensitive system data. No authentication or special privileges are required, and attack complexity is low. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.042% (0.000420), indicating a low near-term exploitation probability (Github Advisory).

1. Reconnaissance: Scan the target network for hosts listening on TCP port 8000 using a tool such as nmap -p 8000 <target_range> to identify instances of mcp-memory-service with the HTTP server enabled.
2. Confirm anonymous access: Send a basic GET /health request to confirm the service is running and responding without authentication.
3. Request detailed health endpoint: Issue an unauthenticated HTTP GET request to the target: curl http://<target_ip>:8000/api/health/detailed
4. Harvest reconnaissance data: Parse the JSON response to extract platform, platform_version, python_version, cpu_count, memory_total_gb, disk_free_gb, and database_path fields.
5. Leverage disclosed information: Use the OS/kernel version and Python version to identify applicable CVEs for further exploitation; use the database_path value (which reveals the system username and home directory) to plan targeted file access or social engineering attacks (Github Advisory).

• Network: Unexpected or repeated unauthenticated HTTP GET requests to /api/health/detailed on port 8000 from external or untrusted IP addresses; port scans targeting TCP 8000 from external hosts.
• Logs: Web server access logs showing GET /api/health/detailed requests with no Authorization header from non-localhost source IPs; high frequency of requests to the health endpoint from a single source.
• Process/Configuration: mcp-memory-service process bound to 0.0.0.0:8000 (visible via netstat or ss -tlnp); environment variable MCP_ALLOW_ANONYMOUS_ACCESS=true set in the service configuration (Github Advisory).

Upgrade mcp-memory-service to version 10.21.0 or later, which patches this vulnerability by removing sensitive system details from the health endpoint and requiring elevated access for detailed health checks (Github Advisory). If immediate upgrade is not possible, apply the following mitigations: (1) Change the service binding from 0.0.0.0 to 127.0.0.1 by setting MCP_HTTP_HOST=127.0.0.1, preventing network-wide exposure; (2) Implement network-level access controls (firewall rules) to restrict access to port 8000 to trusted hosts only; (3) Avoid enabling MCP_ALLOW_ANONYMOUS_ACCESS=true in network-accessible deployments and use OAuth or API key authentication instead.

The vulnerability was reported by researcher yotampe-pluto and published via the GitHub Security Advisory database on March 5, 2026. Red Hat acknowledged the CVE on March 9, 2026. No significant broader media coverage or notable community debate has been identified beyond standard vulnerability tracking and aggregation sites (Github Advisory).