External risk intelligence

mcp-memory-service Unauthenticated API Document Access Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-50027

The service functions as an API for AI applications and exposes HTTP endpoints for document management. Because these services are commonly deployed as web-facing components or integrated into network-accessible AI application stacks, they are frequently reachable via the public internet or exposed at the edge of an application environment.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

The mcp-memory-service, a component used in AI applications for storing and retrieving information, has a critical vulnerability where certain administrative functions are exposed without requiring any authentication. This means an unauthorized remote attacker could potentially access, modify, or delete sensitive data within the memory store, regardless of whether the service is configured for security.

Unprotected AI memory access allows data theft or alteration.
Leadership must confirm if this AI component is in use.
Focus on confirming relevance and exposure to AI systems.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can leverage this vulnerability by sending unauthenticated HTTP requests to specific API endpoints. The service, which handles semantic memory for AI applications, incorrectly allows unauthenticated access to routes under `/api/documents/*`. This bypasses expected authentication, even when API keys or OAuth are configured, enabling unauthorized operations on memory data.

Entry condition: Network accessibility to the service.
Trigger point: Unauthenticated HTTP requests to `/api/documents/*`.
Resulting risk: Unauthorized read, write, and delete operations.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated remote attacker could upload, read, or delete arbitrary content from the memory store. This could occur when the server is configured with an API key or OAuth, but the HTTP routes under `/api/documents/*` are accessed without credentials, creating an inconsistent authentication boundary.

Arbitrary content in memory store.
Unauthenticated remote network access.
Data loss and unauthorized data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for AI application platforms and associated data stores should address this vulnerability. The initial practical step is to identify all instances of mcp-memory-service, determine their network exposure and business criticality, and then locate the accountable system owner. Remediation planning should then proceed based on the identified risk and operational capacity.

Identify accountable application or platform owners.
Verify unauthenticated access to /api/documents/*.
Plan phased remediation during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is mcp-memory-service?

mcp-memory-service is a software component that provides a semantic memory layer for AI applications. It acts as a specialized data store where AI systems save and retrieve information they need to maintain context or recall past interactions. It functions as an API service that manages documents and memory entries, often integrated into larger AI infrastructure stacks to help models process and persist data.

What is the vulnerability in CVE-2026-50027?

This vulnerability is classified as CWE-306, which refers to a Missing Authentication for Critical Function. In plain terms, it means the software fails to verify who is making a request before granting access to sensitive operations. While the service is designed to support security controls like API keys or OAuth, it accidentally leaves specific document management paths open to the public without requiring any credentials at all.

How does an attacker trigger this vulnerability?

An attacker can exploit this by sending unauthenticated HTTP requests specifically to the /api/documents/ path. It is important to note that sending requests to other paths, such as /api/memories, will not trigger the bug because those endpoints correctly enforce authentication. The issue is limited to the inconsistency where the document management routes ignore security requirements that the rest of the service correctly observes.

Why should I care about this flaw?

You should care if your organization runs AI applications using this component. According to Halo Surface Signal, this service is frequently deployed as a web-facing component or at the edge of network-accessible stacks, making it highly reachable. Because the bug allows anyone with network access to read, overwrite, or permanently delete AI data, it presents a significant risk to the integrity and confidentiality of your stored information.

What is the first step to address CVE-2026-50027?

The immediate priority is to locate all instances of mcp-memory-service within your environment to understand where it is running and who is responsible for managing those specific systems. Once identified, verify their current network exposure. Your goal is to coordinate with the system owners to apply the security update to version 10.67.1, which resolves the authentication boundary inconsistency.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.