What happened
NVD published CVE-2026-49986 (CVSS 7.1, High) on 2026-08-14, describing a trust-boundary confusion in the Cortex MCP memory server where the Claude-Code-controlled CLAUDE_PROJECT_DIR environment variable is incorrectly treated as an authoritative trusted path.
Why it matters
This is a novel agent-execution trust-boundary flaw: an MCP tool conflates an environment variable that Claude Code sets based on the user's open folder with a hardened, trusted developer path, illustrating a recurring class of MCP-server bugs that misplace trust in agent-controlled context.
Attack vector
The Cortex MCP server treats CLAUDE_PROJECT_DIR — automatically set by Claude Code to the currently open project directory — as a trusted Cortex developer checkout; the open_visualization (or similar) tool then trusts attacker-influenced project directory content beyond intended scope
Affected systems
Cortex MCP server (neuro-cortex-memory) < 3.17.1
Mitigation
Upgrade to Cortex v3.17.1 or later