CVE-2026-50027: 
Python vulnerability analysis and mitigation

CVE-2026-50027 is a Missing Authentication for Critical Function vulnerability in mcp-memory-service (by doobidoo) that allows unauthenticated remote attackers to read, write, and delete stored memories via unprotected /api/documents/* HTTP endpoints. The vulnerability affects all versions of the mcp-memory-service pip package prior to 10.67.1, and was originally published on May 28, 2026, with the GitHub Advisory Database entry updated on July 2, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory).

The root cause is CWE-306 (Missing Authentication for Critical Function): the documents.py FastAPI router is instantiated as router = APIRouter() without any dependencies= parameter, and the file does not import Depends at all, meaning no authentication guard is applied to any route under /api/documents/*. By contrast, the /api/memories counterpart correctly uses Depends(require_write_access), demonstrating that the authentication infrastructure exists but was simply omitted from the documents router. Affected endpoints include POST /upload, POST /batch-upload, GET /history, GET /search-content/{upload_id}, DELETE /remove/{upload_id}, and DELETE /remove-by-tags — all reachable without credentials even when MCP_API_KEY or OAuth is configured. A public proof-of-concept (PoC) script (poc.py) and Dockerfile are included in the advisory, demonstrating the full six-step attack chain (GitHub Advisory).

An unauthenticated remote attacker can exploit this vulnerability to achieve full confidentiality, integrity, and availability impact on the memory store. Confidentiality is compromised by reading stored document content and enumerating upload history, which may contain sensitive AI agent state, personal notes, or proprietary data. Integrity is compromised by injecting arbitrary attacker-controlled content into the memory store (enabling memory poisoning and prompt injection against AI agents), and availability is compromised by permanently deleting all memories matching attacker-chosen tags — including data created by legitimately authenticated users — with a single unauthenticated HTTP request (GitHub Advisory).

A fully functional PoC exploit script and Dockerfile are publicly available as part of the GitHub Security Advisory, making this trivially exploitable by any attacker with network access to the service. The vulnerability requires no authentication, no user interaction, and no special privileges — only network reachability to the HTTP REST server port. The CVE status is listed as "Reserved" and no CISA KEV catalog entry or EPSS score data is currently available. The vulnerability was reported by EQSTLab (GitHub Advisory).

1. Reconnaissance: Identify instances of mcp-memory-service running in HTTP REST server mode (memory server --http) on the network, typically on port 8000, using tools like Shodan, Censys, or internal network scanning.
2. Confirm authentication boundary: Send GET /api/memories without credentials — a 401 response confirms the auth guard is active on the memories API, establishing that the service is configured with authentication.
3. Write bypass — upload arbitrary content: Send an unauthenticated POST /api/documents/upload multipart request with any file content and desired tags. The server returns HTTP 200 with a valid upload_id, confirming the write bypass:

   curl -X POST http://<target>:8000/api/documents/upload \
     -F "file=@payload.txt" -F "tags=attacker-tag"

4. Read bypass — retrieve stored content: Use the returned upload_id to read stored document content without credentials:

   curl http://<target>:8000/api/documents/search-content/<upload_id>

5. Delete bypass — destroy authenticated user data: Send an unauthenticated DELETE /api/documents/remove-by-tags request with a JSON array of target tags to permanently delete memories belonging to authenticated users:

   curl -X DELETE http://<target>:8000/api/documents/remove-by-tags \
     -H 'Content-Type: application/json' -d '["target-tag"]'

6. Confirm impact: Verify via an authenticated GET /api/memories request that the targeted memories have been permanently deleted, confirming full integrity impact (GitHub Advisory).

• Network: Unauthenticated HTTP POST requests to /api/documents/upload or /api/documents/batch-upload from unexpected source IPs; unauthenticated DELETE requests to /api/documents/remove-by-tags or /api/documents/remove/<id>; unauthenticated GET requests to /api/documents/search-content/<id> or /api/documents/history.
• Logs: HTTP access logs showing 200 responses to /api/documents/* endpoints with no X-API-Key or Authorization header present; sudden drops in memory count visible in authenticated /api/memories responses following unauthenticated DELETE activity.
• Application State: Unexpected documents or memories appearing in the store with attacker-controlled tags (e.g., poc-evidence, cve-poc); legitimate memories disappearing without corresponding authenticated delete operations; upload history entries with unfamiliar filenames or content markers such as CVE_AUTH_BYPASS_MARKER or VULN001_AUTH_BYPASS_ (GitHub Advisory).

Upgrade mcp-memory-service to version 10.67.1 or later, which adds Depends(require_write_access) and Depends(require_read_access) guards to all affected routes in documents.py. As a temporary workaround prior to patching, restrict network access to the HTTP REST server port (default 8000) using firewall rules or reverse proxy authentication to prevent unauthenticated external access. Operators who have deployed the HTTP REST server with MCP_API_KEY or OAuth should treat all data in the memory store as potentially compromised and review upload history for unauthorized entries (GitHub Advisory).

The vulnerability was discovered and reported by EQSTLab, who provided a detailed advisory including a complete PoC script and Dockerfile. The advisory was published to the GitHub Advisory Database on July 2, 2026, and has been detected by Qualys scanners (detection ID 5015060). No broader media coverage or notable social media commentary has been identified at this time (GitHub Advisory).