Read the docs
TI-2026-36477 Aliases CVE-2026-49291GHSA-2r68-g678-7qr3

mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call

Priority LOW 38CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

mcp-memory-service is a semantic memory layer for AI applications. Prior to version 10.65.3, the HTTP MCP JSON-RPC endpoint at `/mcp` requires only OAuth `read` scope for all requests, then dispatches `tools/call` directly to handlers that include mutating tools. A read-only OAuth client can call `store_memory` and `delete_memory` through MCP even though the corresponding REST endpoints require `write` scope. Version 10.65.3 patches the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00488 42nd percentileScored 2026-11-07
Fix Fixed mcp-memory-service (doobidoo): 10.65.3mcp-memory-service (PyPI): 10.65.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
doobidoomcp-memory-servicebefore 10.65.310.65.3Patch availableCNA
—mcp-memory-service (PyPI)before 10.65.310.65.3Patch availableGHSA-2r68-g678-7qr3
  • mcp-memory-service Vendordoobidoo Affected before 10.65.3 Fixed in 10.65.3 Patch available CNA
  • mcp-memory-service (PyPI) Vendor— Affected before 10.65.3 Fixed in 10.65.3 Patch available GHSA-2r68-g678-7qr3

Remediation

  • Fix · CNA mcp-memory-service (doobidoo) Fixed in 10.65.3
  • Fix · GHSA-2r68-g678-7qr3 mcp-memory-service (PyPI) Fixed in 10.65.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49291
  2. 2026-10-03 Alias added: GHSA-2r68-g678-7qr3

References

Advisory 1

Other 5

  • TI-2026-25457 mcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theft CVSS 3.1HIGH 8.8
  • TI-2026-23373 mcp-memory-service: System Information Disclosure via Health Endpoint CVSS 3.1MEDIUM 5.3
  • TI-2026-36853 mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences