Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.25.1, when the HTTP server is enabled (MCP_HTTP_ENABLED=true), the application configures FastAPI's CORSMiddleware with allow_origins=['*'], allow_credentials=True, allow_methods=["*"], and allow_headers=["*"]. The wildcard Access-Control-Allow-Origin: * header permits any website to read API responses cross-origin. When combined with anonymous access (MCP_ALLOW_ANONYMOUS_ACCESS=true) - the simplest way to get the HTTP dashboard working without OAuth - no credentials are needed, so any malicious website can silently read, modify, and delete all stored memories. This issue has been patched in version 10.25.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-20 | 1 | Disclosure1 |
| 2026-03-22 | 1 | General1 |
| 2026-03-27 | 1 | General1 |
CVE-2026-33010: mcp-memory-service Cross-Origin Memory Theft - What It Means for Your Business and How to Respond https://hubs.li/Q048DJrD0
Post summary
The text announces a CVE with a brief description of a cross‑origin memory theft vulnerability but provides no detailed technical data, exploit code, or patch information, making it a general advisory.
CVE-2026-33010 mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.25.1, when the HTTP server is enabled (MCP_HTTP_ENABLED=true), the ap… https://www.cve.org/CVERecord?id=CVE-2026-33010
Post summary
The text briefly notes a CVE affecting mcp-memory-service before version 10.25.1 when the HTTP server is enabled, but it offers none of the detailed technical, exploit, patch, or mitigation information.
🟠 CVE-2026-33010 - High mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.25.1, when the HTTP server is enabled (MCP_HTTP_ENABLED=true), the application configures Fast... https://www.thehackerwire.com/vulnerability/CVE-2026-33010/ https://t.co/5TyQA4Dzkx
Post summary
The tweet announces a new high‑severity vulnerability (CVE‑2026‑33010) in mcp‑memory‑service, indicating it is fixed in version 10.25.1 and linking to a detailed article.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | doobidoo | mcp-memory-service | - | - | - |