CVE-2026-112157: Resource Consumption in MemTensor memmy-agent

MemTensor memmy-agent versions 1.0.0 to 1.2.2 contain a resource consumption vulnerability in the requireAdminWrite function within Memory/src/server/http.ts. The vulnerability arises because the POST /api/v1/admin/shutdown endpoint accepts unauthenticated requests if no token is configured. Although this endpoint was intended for local use and has received cross-origin request fixes, unauthenticated endpoint exposure remains confirmed. Remote exploitation is possible but requires high attack complexity and is difficult. The exploit code is publicly available but partially overstated, as browser-triggered denial-of-service depends on specific browser behaviors.

The vulnerability can lead to resource consumption on the affected system, potentially causing denial-of-service conditions. Remote attackers can exploit this via unauthenticated POST requests to the shutdown endpoint if no authentication token is configured. However, the attack complexity is high and exploitation is difficult. The impact is limited to resource exhaustion without further privilege escalation or data compromise. The CVSS score of 2.3 reflects a low severity impact.

No official patch or fix information is provided. Since the vulnerability depends on the absence of an authentication token, configuring authentication tokens for the /api/v1/admin/shutdown endpoint is recommended to prevent unauthenticated access. Additionally, ensure that cross-origin request protections are properly applied. Monitor vendor advisories for any forthcoming patches or official mitigations. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.