CVE-2026-50027: Unauthenticated Document API Access in MCP Memory Service
What's the Vulnerability
CVE-2026-50027 is a missing authentication vulnerability (CWE-306) in mcp-memory-service, a Python package distributed via pip that stores memory/document state for AI agent workflows. Versions prior to 10.67.1 expose API endpoints for reading, writing, and deleting stored memory documents without requiring any authentication. An attacker who can reach the service over the network can enumerate, exfiltrate, tamper with, or destroy stored AI agent memory contents with no credentials at all.
The root cause is a missing authorization check at the API layer — endpoints intended for internal or authenticated use were left reachable by any client that can send an HTTP request to the service. Given the CVSS score of 9.8, this is a critical, low-complexity, unauthenticated attack path with high impact on confidentiality, integrity, and availability of stored data.
Affected Software
- Vendor/Distribution: pip
- Product: mcp-memory-service
- Affected versions: < 10.67.1
No patched version date has been published in our source data at this time — organizations running mcp-memory-service should verify their deployed version against 10.67.1 and treat any instance below that threshold as vulnerable.
Exploitation Status
This vulnerability is currently tracked as PoC public — a proof-of-concept exploit is available, but there is no confirmed evidence of active weaponized campaigns or inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog as of this detection's disclosure on July 2, 2026. Defenders should treat public PoC availability as a strong signal that opportunistic scanning and exploitation attempts are likely to follow quickly, especially given the trivial exploitation complexity (no authentication required).
How Our Detection Catches It
Because exploitation of CVE-2026-50027 requires no authentication, detection logic focuses on identifying anomalous or unauthorized access patterns to the exposed memory/document API endpoints rather than on credential misuse. At a high level, our shipped detections look for:
- Requests to
mcp-memory-servicedocument/memory endpoints that lack expected authentication context or session state - Unusual read, write, or delete volume against memory document endpoints from a single source in a short window, indicative of enumeration or bulk exfiltration
- Delete or overwrite operations against stored memory documents originating from unexpected or previously unseen source hosts
This logic is shipped across our full SIEM coverage matrix: Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), IBM QRadar (AQL), Sumo Logic, Google Chronicle (YARA-L), and CrowdStrike (CQL) — so teams can deploy the detection in whichever platform anchors their SOC without rewriting logic from scratch.
Get the Full Detection
For the complete KQL, SPL, and other platform-specific queries, MITRE ATT&CK mapping, and remediation guidance for CVE-2026-50027, see the full detection page: https://df00tech.com/detections/CVE-2026-50027.