CVE-2026-50027 doobidoo CVE debrief

Who should care

Defenders and security teams responsible for AI applications using mcp-memory-service should assess exposure and prioritize remediation. This vulnerability has a critical CVSS score of 9.8 and allows unauthenticated remote attacks, making it a high-priority concern.

Why it matters

CVE-2026-50027 is a critical vulnerability in mcp-memory-service that allows unauthenticated remote attackers to upload, retrieve, and delete memories without supplying any credentials. Defenders and security teams responsible for AI applications using mcp-memory-service should assess exposure and prioritize remediation.

• Unauthenticated remote attackers can upload arbitrary content into the memory store
• Unauthenticated remote attackers can retrieve stored document content
• Unauthenticated remote attackers can permanently delete memories belonging to authenticated users
• Verify authentication and authorization for HTTP routes under /api/documents/*

Technical summary

The mcp-memory-service vulnerability allows unauthenticated remote attackers to upload, retrieve, and delete memories without supplying any credentials. This is because all HTTP routes under /api/documents/* in mcp-memory-service are served without any authentication dependency, even when the server is configured with an API key or OAuth. The vulnerability is fixed in version 10.67.1. Affected product deployments should be reviewed for exposure, and remediation should be prioritized due to the critical CVSS score of 9.8 and potential for unauthenticated remote attacks.

Defensive priority

High

Recommended defensive actions

• Review and update mcp-memory-service to version 10.67.1 or later
• Implement authentication and authorization for HTTP routes under /api/documents/*
• Monitor for suspicious activity and implement compensating controls
• Verify the vulnerability and assess exposure in your environment
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The vulnerability is confirmed by the CVE Program and NVD. The CVE Program record and NVD vulnerability detail page provide official information about the vulnerability. Additional information is available from source references, including GitHub advisories and the PyPI project page.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.