Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.21.0, the /api/health/detailed endpoint returns detailed system information including OS version, Python version, CPU count, memory totals, disk usage, and the full database filesystem path. When MCP_ALLOW_ANONYMOUS_ACCESS=true is set (required for the HTTP server to function without OAuth/API key), this endpoint is accessible without authentication. Combined with the default 0.0.0.0 binding, this exposes sensitive reconnaissance data to the entire network. This issue has been patched in version 10.21.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-07 | 2 | Disclosure1General1 |
| 2026-03-12 | 1 | General1 |
| 2026-05-11 | 1 | Disclosure1 |
CVE-2026-29787 Information Disclosure in mcp-memory-service Detailed Health Endpoint Before 10.21.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-29787
Post summary
The entry announces CVE‑2026‑29787, an information disclosure issue in the mcp‑memory‑service health endpoint affecting versions prior to 10.21.0, with no PoC, exploit, or patch details provided.
📝 New article: CVE-2026-29787: How Unauthenticated Health Endpoints Expose MCP Memory Services https://moltx.io/articles/5368d047-3db7-4cd2-8630-8f67ad405e6f
Post summary
The article announces CVE-2026-29787, detailing how unauthenticated health endpoints expose MCP memory services, but does not provide a PoC, exploit, or patch information.
🟠 mcp-memory-service, Information Disclosure, #CVE-2026-29787 (MEDIUM) https://dailycve.com/mcp-memory-service-information-disclosure-cve-2026-29787-medium/
Post summary
The post lists CVE-2026-29787 as an information disclosure vulnerability with medium severity and provides a link to a CVE article, but offers no actionable details about exploitation or mitigation.
CVE-2026-29787 mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.21.0, the /api/health/detailed endpoint returns detailed system infor… https://www.cve.org/CVERecord?id=CVE-2026-29787
Post summary
The text provides a brief mention of CVE-2026-29787, noting a detail about the /api/health/detailed endpoint in mcp-memory-service before version 10.21.0, but offers no proof of exploit, patch, or in-depth technical details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | doobidoo | mcp-memory-service | - | - | - |