MCP Memory Service Unauthenticated Document API Access (CVE-2026-50027)

let TargetPaths = dynamic(["/api/documents", "/api/memory", "/mcp/documents", "/documents"]);
CommonSecurityLog
| union (W3CIISLog)
| union (AzureDiagnostics | where Category == "ApplicationGatewayAccessLog")
| extend RequestUrl = coalesce(RequestURL, requestUri_s, cs_uri_stem_s)
| where RequestUrl has_any (TargetPaths)
| where HTTPMethod in ("GET", "POST", "PUT", "DELETE") or csMethod_s in ("GET", "POST", "PUT", "DELETE")
| where isempty(Authorization) or Authorization == "-" or isempty(User) or User == "-"
| summarize RequestCount = count(), Methods = make_set(HTTPMethod), Paths = make_set(RequestUrl) by SourceIP = coalesce(SourceIP, cIP_s), bin(TimeGenerated, 5m)
| where RequestCount > 5
| project TimeGenerated, SourceIP, RequestCount, Methods, Paths

index=web_proxy OR index=app_logs sourcetype=access_combined OR sourcetype=nginx:plus:access
| regex uri_path="(?i)/(api/)?(documents|memory)"
| eval has_auth=if(isnotnull(Authorization) OR isnotnull(auth_header) OR match(_raw, "Authorization:"), 1, 0)
| where has_auth=0
| stats count as request_count, values(method) as methods, values(uri_path) as paths, values(status) as statuses by src_ip, _time span=5m
| where request_count > 5
| sort -request_count

sequence by source.ip with maxspan=5m
  [network where url.path : ("/api/documents", "/api/memory", "/documents") and http.request.method : ("GET","POST","PUT","DELETE") and (http.request.headers.authorization == null or http.request.headers.authorization : "")]
  [network where url.path : ("/api/documents", "/api/memory", "/documents") and http.request.method : ("DELETE","PUT")]

SELECT sourceip, destinationip, URL, "HTTP Method", COUNT(*) as requestCount
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%HTTP%'
AND (URL ILIKE '%/api/documents%' OR URL ILIKE '%/api/memory%' OR URL ILIKE '%/documents%')
AND ("HTTP Method" IN ('GET','POST','PUT','DELETE'))
AND (UTF8(payload) NOT ILIKE '%Authorization:%')
GROUP BY sourceip, destinationip, URL, "HTTP Method"
HAVING COUNT(*) > 5
LAST 24 HOURS

_sourceCategory=web/proxy OR _sourceCategory=app/mcp-memory-service
| parse "* * * \"* * *\"" as src_ip, ident, user, method, uri, proto
| where uri matches "*documents*" or uri matches "*memory*"
| where !(_raw matches "*Authorization:*")
| timeslice 5m
| count by src_ip, method, uri, _timeslice
| where _count > 5

rule mcp_memory_service_unauth_access {
  meta:
    author = "df00tech"
    description = "Detects unauthenticated access to mcp-memory-service document API endpoints (CVE-2026-50027)"
    severity = "CRITICAL"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.url = /.*(\/api\/documents|\/api\/memory|\/documents).*/
    $e.network.http.method in ("GET", "POST", "PUT", "DELETE")
    not $e.network.http.request_headers = /(?i)Authorization/

  match:
    $e.principal.ip over 5m

  condition:
    #e > 5
}

#event_simpleName=HttpRequest
| RequestURI=/*documents*/ OR RequestURI=/*memory*/
| HttpMethod=GET OR HttpMethod=POST OR HttpMethod=PUT OR HttpMethod=DELETE
| RequestHeaders!="*Authorization*"
| stats count() as requestCount by ClientIP, RequestURI, HttpMethod, bucket(5m, timestamp)
| test(requestCount > 5)