Cross-Origin Resource Sharing Misconfiguration in mcp-memory-service by Doobidoo

CVE-2026-33010

What is CVE-2026-33010?

The mcp-memory-service, an open-source memory backend for multi-agent systems, is affected by a serious CORS misconfiguration prior to version 10.25.1. When the HTTP server is enabled, FastAPI's CORSMiddleware is configured to allow all origins, methods, headers, and credentials. This configuration enables any malicious website to access the API without authentication, allowing it to read, modify, and delete all stored memories. The issue arises when the MCP_ALLOW_ANONYMOUS_ACCESS setting is true, making it unnecessarily easy for unauthorized entities to exploit the API. Upgrading to version 10.25.1 remedies this vulnerability.

References