CVE-2026-50027Disclosure

NewNormal Security turns the last 24 hours of CVEs into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 15 Aug 2026 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 🖥️ Unauthenticated AI memory server — everything an assistant was told to remember is readable, and rewritable, by anyone who can reach the port (mcp-memory-service CVE-2026-50027) 🖥️ Unauthenticated database SQL endpoint — arbitrary SELECT, INSERT and DROP on every table, no credential (CrateDB) 🔓 Unfinished CMS installer left reachable — whoever loads the page first picks the admin password and owns the server (WordPress, as seen in Emlog CVE-2026-73849) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #ExposedInterface #CSO #REDTEAM

🚨Critical - mcp-memory-service Missing Auth on Document API (CVE-2026-50027) In MCP-Memory-Service's HTTP REST server, all /api/documents/* routes are served with no authentication guard - even when MCP_API_KEY or OAuth is configured. The http://documents.py router never applies Depends(), unlike the correctly protected/api/memories routes, creating an inconsistent and exploitable auth boundary. An unauthenticated remote attacker can upload arbitrary content (write), read stored document content and history (read), and delete other users' memories by tag (delete) - no credentials needed. A PoC shows an unauthenticated request wiping data created by an authenticated user, and the write path enables memory poisoning / prompt injection of the AI agent's knowledge base. 👉Upgrade to mcp-memory-service 10.67.1.