CVE-2026-49291: mcp-memory-service Authorization Bypass Allows Read-Only Users to Modify Data

Technical summary

The vulnerability stems from inconsistent authorization enforcement between two API endpoints. The `/mcp` HTTP endpoint validates only that incoming requests carry an OAuth `read` scope before accepting and dispatching JSON-RPC `tools/call` requests. However, the MCP layer fails to re-validate permission levels when routing to specific tool handlers, including those that mutate state. The `store_memory` and `delete_memory` tools are implemented as handlers without scope gating, allowing them to be called by read-scoped OAuth clients. In contrast, equivalent REST endpoints properly enforce `write` scope requirements. The flaw is classified as improper authorization (CWE-862) and affects the integrity and availability of stored memory resources.

Business impact

This vulnerability can result in unauthorized modification or deletion of semantic memory used by AI applications. An attacker with limited read-only API access could corrupt, erase, or manipulate memory stores that other parts of the application or users depend on. For organizations running AI systems that use mcp-memory-service as a backend, this could degrade model context quality, cause application logic failures, or enable data loss attacks. The impact is heightened in multi-tenant or shared-memory scenarios where one read-only token could compromise data integrity for other users or applications.

Affected systems

All versions of mcp-memory-service prior to version 10.65.3 are affected. Organizations using mcp-memory-service to manage semantic memory for AI workloads should verify their installed version. The advisory does not list specific vendor products bundling this service, so you should check your deployment's component inventory and dependency trees for mcp-memory-service and its version.

Exploitability

Exploitation requires network access to the `/mcp` endpoint and possession of valid OAuth credentials with at least read scope. No user interaction or complex configuration is needed; an attacker with a standard read-only API token can immediately call mutating tools. The attack is straightforward to execute once credentials are obtained, making this a practical risk for any organization where read-scope tokens are distributed or where credential leakage is a concern.

Remediation

Upgrade mcp-memory-service to version 10.65.3 or later. The patched version enforces proper OAuth scope validation at the MCP endpoint level, ensuring that `tools/call` dispatch includes permission checks commensurate with the requested operation. Verify against the vendor advisory that 10.65.3 is the minimum safe version for your deployment.

Patch guidance

Plan an upgrade to version 10.65.3 as soon as feasible, prioritizing systems that expose the `/mcp` endpoint to untrusted networks or where read-only tokens are widely distributed. The patch involves updating the mcp-memory-service package; consult the vendor release notes for any breaking changes or configuration adjustments. Test the upgrade in a staging environment to confirm that existing read-scope clients remain functional for legitimate read operations while being blocked from store_memory and delete_memory calls.

Detection guidance

Monitor logs for `tools/call` requests to `store_memory` or `delete_memory` coming from OAuth tokens with only read scope. API gateway or application logs should record the scope associated with each request; filter for calls that mismatch operation severity and scope. Also monitor for unusual patterns of memory deletion or modification that correlate with low-privilege token activity. If you have audit logging on memory operations, cross-reference the user/token identity with the scope they were granted.

Why prioritize this

This vulnerability scores CVSS 8.1 (HIGH) due to low attack complexity, no user interaction requirement, and high impact on integrity and availability. The ability for read-only users to perform write operations directly undermines access control assumptions and can lead to data loss or corruption. Organizations should treat this as a high-priority patch, especially if read-only API tokens are issued to third parties, partner integrations, or less-trusted applications.

Risk score, explained

The CVSS 8.1 score reflects a network-accessible endpoint (AV:N), low attack complexity (AC:L), and the requirement for a low-privileged authenticated account (PR:L). The vulnerability does not require user interaction (UI:N) and is scoped to the affected component (S:U). The impact is high for both integrity (I:H)—unauthorized modification of memory—and availability (A:H)—unauthorized deletion—while confidentiality is not directly compromised. The combination of easy exploitation and serious write-access abuse justifies the HIGH severity rating.

Frequently asked questions