CVE-2026-33010: 
Python vulnerability analysis and mitigation

CVE-2026-33010 is a permissive Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability in mcp-memory-service, an open-source memory backend for multi-agent systems. Prior to version 10.25.1, when the HTTP server is enabled (MCP_HTTP_ENABLED=true), the application configures FastAPI's CORSMiddleware with allow_origins=['*'], allow_credentials=True, allow_methods=["*"], and allow_headers=["*"], permitting any website to read API responses cross-origin. When combined with anonymous access (MCP_ALLOW_ANONYMOUS_ACCESS=true), no credentials are required, enabling any malicious website to silently read, modify, and delete all stored memories. The vulnerability was published on March 20, 2026, and patched in version 10.25.1. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory).

The root cause is classified as CWE-942 (Permissive Cross-domain Policy with Untrusted Domains). The application's FastAPI CORSMiddleware is configured with a wildcard Access-Control-Allow-Origin: * header alongside allow_credentials=True, which — while technically contradictory per the CORS specification — combined with anonymous access (MCP_ALLOW_ANONYMOUS_ACCESS=true) removes all authentication barriers. An attacker can host a malicious webpage that issues cross-origin JavaScript fetch() or XMLHttpRequest calls to the victim's locally or network-accessible mcp-memory-service API endpoints. Because no credentials or authentication tokens are required in anonymous mode, the browser will complete the cross-origin request and return the full API response to the attacker's script. A self-contained Python PoC using FastAPI and TestClient is included in the security advisory, demonstrating the vulnerable response headers (GitHub Advisory).

Successful exploitation allows an unauthenticated attacker — operating through a malicious website visited by a victim — to silently read, modify, and delete all memories stored in the mcp-memory-service API. This results in high confidentiality impact (exposure of all stored agent memory data), high integrity impact (ability to tamper with or inject false memories), and high availability impact (ability to delete all stored memories). In multi-agent AI systems, memory poisoning or deletion could have cascading effects on downstream agent behavior and decision-making (GitHub Advisory).

A public proof-of-concept (PoC) exploit is available in the GitHub Security Advisory, consisting of a runnable Python script that demonstrates the CORS vulnerability by simulating a cross-origin request from https://evil.com and confirming the vulnerable access-control-allow-origin: * response header. There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.03% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — a victim must visit a malicious website while the vulnerable service is running and accessible (GitHub Advisory).

1. Reconnaissance: Identify targets running mcp-memory-service with MCP_HTTP_ENABLED=true and MCP_ALLOW_ANONYMOUS_ACCESS=true. The service typically listens on a local or network-accessible port (e.g., http://localhost:8000 or a LAN IP).
2. Craft malicious webpage: Create an HTML page with embedded JavaScript that issues cross-origin fetch() requests to the target mcp-memory-service API endpoints (e.g., GET /api/memories, POST /api/memories, DELETE /api/memories/{id}).
3. Host the malicious page: Serve the page from an attacker-controlled domain (e.g., https://evil.com) and socially engineer the victim into visiting it.
4. Trigger cross-origin request: When the victim's browser loads the page, the JavaScript silently sends requests to the mcp-memory-service API. Because allow_origins=['*'] is set and no authentication is required, the browser completes the request and returns the full API response to the attacker's script.
5. Exfiltrate or manipulate data: The attacker's script reads all stored memories (confidentiality breach), injects false or malicious memory entries (integrity breach), or deletes all memories (availability breach), then exfiltrates the data to an attacker-controlled server (GitHub Advisory).

• Network: Unexpected cross-origin HTTP requests to mcp-memory-service API endpoints (e.g., /api/memories) originating from browser sessions; outbound data transfers from the host running mcp-memory-service to unknown external IPs.
• Logs: API access logs showing requests to memory endpoints with Origin headers from untrusted or unknown domains; high volumes of GET, POST, or DELETE requests to memory endpoints without corresponding authenticated sessions.
• Application Behavior: Unexpected deletion or modification of stored memory entries; appearance of unfamiliar or injected memory records in the memory store.
• Configuration: Presence of MCP_HTTP_ENABLED=true and MCP_ALLOW_ANONYMOUS_ACCESS=true environment variables in the service configuration, combined with a version earlier than 10.25.1 (GitHub Advisory).

Upgrade mcp-memory-service to version 10.25.1 or later, which patches the overly permissive CORS configuration. As interim workarounds: restrict allow_origins in CORSMiddleware to explicitly trusted domains rather than using a wildcard; disable anonymous access (MCP_ALLOW_ANONYMOUS_ACCESS=false) and require OAuth or other authentication for API access; and avoid exposing the HTTP server to untrusted networks if not required. Restricting network access to the service (e.g., binding only to localhost or using a firewall) further reduces the attack surface (GitHub Advisory).

The vulnerability received limited but notable attention in the security community, with automated CVE tracking services (cvefeed.io, vuldb.com, radar.offseq.com) and European vulnerability databases (EUVD-2026-13766 via ENISA) picking up the disclosure shortly after publication. A brief mention appeared on Bluesky via the CVE tracking account. No major vendor statements or prominent researcher commentary beyond the GitHub advisory have been identified (GitHub Advisory).