Skip to content

Back to the catalog

nvd.nist.govadvisory

CVE-2026-49291: mcp-memory-service is a semantic memory layer for AI applications

CVE-2026-49291 affects mcp-memory-service prior to version 10.65.3: its HTTP MCP JSON-RPC endpoint at /mcp only enforced OAuth 'read' scope before dispatching tools/call requests, so a client holding only read access could invoke mutating tools like store_memory and delete_memory even though the equivalent REST endpoints correctly required 'write' scope. The flaw is a classic missing-authorization bug (CWE-862) surfacing specifically in an MCP tool-dispatch layer, scored CVSS 3.1 8.1 (High) with confidentiality unaffected but integrity and availability impacted. Fixed in 10.65.3.

TL;DR OAuth read-scope clients could call write-privileged MCP tools (store_memory/delete_memory) in mcp-memory-service before v10.65.3 due to missing authorization checks in tool dispatch.
Open original ↗
Document

What it is

CVE-2026-49291 is a missing authorization flaw (CWE-862) in mcp-memory-service, a semantic memory layer for AI applications, rated CVSS 3.1 8.1 HIGH (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). It affects all versions prior to 10.65.3 and is fixed in 10.65.3. Published 2026-06-19.

How it works

The HTTP MCP JSON-RPC endpoint at /mcp enforces only the OAuth read scope on every request. Once past that check, it dispatches tools/call directly to handlers — including mutating tools — without a per-tool scope check. So a client holding only a read token can invoke store_memory and delete_memory over MCP, even though the equivalent REST endpoints correctly demand write scope. The authorization gap exists only on the MCP path; the REST path is not affected.

This matches the CVSS vector: no confidentiality impact (C:N) but high integrity and availability impact (I:H/A:H), reflecting that a read-only client can create and destroy stored memories.

flowchart TD
    C[OAuth client, read scope only] -->|POST /mcp tools/call| G{scope check}
    G -->|only 'read' required| H[handler dispatch]
    H --> W[store_memory / delete_memory]
    C -.->|POST REST write endpoint| R{write scope required}
    R -->|denied| X[blocked]

Preconditions / Affected

  • mcp-memory-service before 10.65.3.
  • The HTTP MCP JSON-RPC endpoint (/mcp) reachable by the client (AV:N).
  • Attacker holds a valid OAuth token with at least read scope (PR:L) — i.e., a legitimate read-only client, not an unauthenticated outsider.

What to do

Upgrade to 10.65.3, which patches the issue. The fixed package is published at https://pypi.org/project/mcp-memory-service/10.65.3. Until then, treat any OAuth read token as effectively holding write/delete capability over the memory store via /mcp, and restrict who can reach that endpoint. See the advisory GHSA-2r68-g678-7qr3 for details.

Caveats

Status is Deferred in NVD. The advisory does not describe a mitigation short of upgrading; scope-restriction at the network layer is an inference from the mechanism, not a vendor-stated workaround.

CVEs named here

Technologies named here

Techniques named here

Related in AppSec