CVE-2026-49986 cdeust CVE debrief

Who should care

Defenders who are responsible for the security of the Cortex MCP server should be aware of this vulnerability and take steps to verify the integrity of the server and ensure that it is updated to version 3.17.1 or later. Additionally, developers who use the Cortex MCP server in their applications should be aware of this vulnerability and take steps to prevent exploitation.

Why it matters

CVE-2026-49986 is a high-severity vulnerability in the Cortex MCP server that allows an attacker to execute arbitrary code with the privileges of the victim's local user process. Defenders should prioritize verifying the integrity of the Cortex MCP server and ensuring that it is updated to version 3.17.1 or later. Developers who use the Cortex MCP server in their applications should be aware of this vulnerability and take steps to prevent exploitation.

• Code execution with the privileges of the victim's local user process.
• Potential for lateral movement and further exploitation.
• Need for verification of Cortex MCP server integrity and version.
• Potential for data tampering or theft.

Technical summary

The Cortex MCP server (`neuro-cortex-memory`), a cross-platform persistent memory MCP, prior to version 3.17.1 treats the `CLAUDE_PROJECT_DIR` environment variable — automatically set by Claude Code to the currently open project directory — as a trusted Cortex developer checkout. When the `open_visualization` tool is invoked, `_find_dev_source()` resolves the user's active project directory as a candidate Cortex source root. The only validation performed by `_is_cortex_root()` is a check for the presence of an `mcp_server/` subdirectory and a `ui/unified-viz.html` file. An attacker who places these two marker files in a malicious repository can cause Cortex to execute an arbitrary `mcp_server/server/visualize_bootstrap.py` from that directory via `subprocess.run([sys.executable, ...])`, achieving code execution with the privileges of the victim's local user process.

Defensive priority

Defenders should prioritize verifying the integrity of the Cortex MCP server and ensuring that it is updated to version 3.17.1 or later. Additionally, defenders should monitor for suspicious activity and implement compensating controls to prevent exploitation.

Recommended defensive actions

• Verify the integrity of the Cortex MCP server and ensure that it is updated to version 3.17.1 or later.
• Monitor for suspicious activity and implement compensating controls to prevent exploitation.
• Implement secure coding practices to prevent similar vulnerabilities in the future.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The evidence for this vulnerability comes from the official CVE Program record and the NIST National Vulnerability Database. The vulnerability is caused by the incorrect trust of the `CLAUDE_PROJECT_DIR` environment variable, which can be exploited by placing marker files in a malicious repository. The vendor has released a fix in version 3.17.1.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.