Memory Backend Vulnerability in mcp-memory-service by Doobidoo

CVE-2026-29787

What is CVE-2026-29787?

The mcp-memory-service prior to version 10.21.0 features an endpoint (/api/health/detailed) that exposes critical system information such as OS version, Python version, CPU count, memory totals, disk usage, and the database filesystem path. This endpoint is accessible without authentication under the condition that MCP_ALLOW_ANONYMOUS_ACCESS is set to true for the HTTP server to operate without OAuth/API key. Coupled with the default binding to 0.0.0.0, this creates a significant security risk, allowing unauthorized access to sensitive reconnaissance data across the entire network. The vulnerability has been addressed in version 10.21.0.

References