CVE-2026-50027: CWE-306: Missing Authentication for Critical Function in doobidoo mcp-memory-service
mcp-memory-service is a semantic memory layer for AI applications. Prior to 10.67.1, all HTTP routes under /api/documents/* in mcp-memory-service are served without any authentication dependency, even when the server is configured with an API key (MCP_API_KEY) or OAuth. An unauthenticated remote attacker can upload arbitrary content into the memory store (write), retrieve stored document content (read), and permanently delete memories belonging to authenticated users (delete) — all without supplying any credentials. The /api/memories counterpart correctly enforces authentication, making this an inconsistent and exploitable authentication boundary. This vulnerability is fixed in 10.67.1.
AI Analysis
Technical Summary
The mcp-memory-service component of doobidoo, used as a semantic memory layer for AI applications, has a missing authentication vulnerability (CWE-306) affecting all HTTP routes under /api/documents/* prior to version 10.67.1. Despite server configurations requiring API key or OAuth authentication, these routes allow unauthenticated access, enabling attackers to upload arbitrary content, retrieve stored documents, and delete memories of authenticated users without credentials. The /api/memories routes enforce authentication correctly, indicating an inconsistent implementation. The vulnerability is addressed and fixed in version 10.67.1.
Potential Impact
An unauthenticated remote attacker can fully compromise the confidentiality, integrity, and availability of the memory store by reading sensitive stored documents, injecting arbitrary content, and deleting existing memories belonging to authenticated users. This can lead to data leakage, data tampering, and denial of service for legitimate users. The CVSS 3.1 score of 9.8 reflects the critical severity of this vulnerability.
Mitigation Recommendations
Upgrade mcp-memory-service to version 10.67.1 or later, where authentication enforcement for /api/documents/* routes is properly implemented. Until the upgrade, restrict network access to the service to trusted users only. Patch status is confirmed fixed in 10.67.1.
CVE-2026-50027: CWE-306: Missing Authentication for Critical Function in doobidoo mcp-memory-service
Description
mcp-memory-service is a semantic memory layer for AI applications. Prior to 10.67.1, all HTTP routes under /api/documents/* in mcp-memory-service are served without any authentication dependency, even when the server is configured with an API key (MCP_API_KEY) or OAuth. An unauthenticated remote attacker can upload arbitrary content into the memory store (write), retrieve stored document content (read), and permanently delete memories belonging to authenticated users (delete) — all without supplying any credentials. The /api/memories counterpart correctly enforces authentication, making this an inconsistent and exploitable authentication boundary. This vulnerability is fixed in 10.67.1.
CVSS v3.1
Score 9.8critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The mcp-memory-service component of doobidoo, used as a semantic memory layer for AI applications, has a missing authentication vulnerability (CWE-306) affecting all HTTP routes under /api/documents/* prior to version 10.67.1. Despite server configurations requiring API key or OAuth authentication, these routes allow unauthenticated access, enabling attackers to upload arbitrary content, retrieve stored documents, and delete memories of authenticated users without credentials. The /api/memories routes enforce authentication correctly, indicating an inconsistent implementation. The vulnerability is addressed and fixed in version 10.67.1.
Potential Impact
An unauthenticated remote attacker can fully compromise the confidentiality, integrity, and availability of the memory store by reading sensitive stored documents, injecting arbitrary content, and deleting existing memories belonging to authenticated users. This can lead to data leakage, data tampering, and denial of service for legitimate users. The CVSS 3.1 score of 9.8 reflects the critical severity of this vulnerability.
Mitigation Recommendations
Upgrade mcp-memory-service to version 10.67.1 or later, where authentication enforcement for /api/documents/* routes is properly implemented. Until the upgrade, restrict network access to the service to trusted users only. Patch status is confirmed fixed in 10.67.1.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-84hp-mqvj-3p8h
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-50027"]
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- CRITICAL
- Cvss Version
- 3.1
Threat ID: 6a46ecdd27e9c7971943f875
Added to database: 07/02/2026, 22:57:33 UTC
Last enriched: 08/23/2026, 11:19:50 UTC
Last updated: 09/14/2026, 10:33:41 UTC
Views: 376
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.