Skip to content

Back to the catalog

advisories.gitlab.comadvisory

AI Security Briefing

CVE-2026-50027 describes a critical missing-authentication flaw in mcp-memory-service, a PyPI-hosted MCP server used for persistent AI agent memory. All routes under /api/documents/* bypass the server's MCP_API_KEY/OAuth authentication checks (unlike the properly-protected /api/memories endpoints), letting unauthenticated remote attackers read, write, and permanently delete stored memories. GitLab rates it CVSS 9.8 Critical.

TL;DR Unauthenticated read/write/delete on mcp-memory-service's document API endpoints — auth check simply missing on that route group (CVE-2026-50027, CVSS 9.8).
Open original ↗

CVEs named here

  • CVE-2026-50027

Technologies named here

Techniques named here

  • Missing authentication on API endpoints
  • Inconsistent authentication boundary

Related in AI Security