What happened
NVD published CVE-2026-50027 (CVSS 9.8, Critical) on 2026-08-14. mcp-memory-service, a semantic memory layer MCP server for AI applications, exposed all /api/documents/* routes without authentication enforcement even when API keys or OAuth were configured, prior to 10.67.1.
Why it matters
MCP memory servers hold persistent context and potentially sensitive data for AI agents across sessions; a total authentication bypass allows any remote attacker to read or corrupt an agent's long-term memory store, undermining trust in AI-agent decision-making built on that memory.
Attack vector
All HTTP routes under /api/documents/* are served without any authentication dependency even when MCP_API_KEY or OAuth is configured, allowing an unauthenticated remote attacker to read/manipulate stored semantic memory documents
Affected systems
mcp-memory-service < 10.67.1
Mitigation
Upgrade to mcp-memory-service 10.67.1 or later