Vulnerability · Published Mar 20, 2026 · Assigned by GitHub_M
CVE-2026-33010mcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theft
High 8.1
In plain English
A high-severity security flaw in mcp-memory-service from doobidoo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.25.1, when the HTTP server is enabled (MCP_HTTP_ENABLED=true), the application configures FastAPI's CORSMiddleware with allow_origins=['*'], allow_credentials=True, allow_methods=["*"], and allow_headers=["*"]. The wildcard Access-Control-Allow-Origin: * header permits any website to read API responses cross-origin. When combined with anonymous access (MCP_ALLOW_ANONYMOUS_ACCESS=true) - the simplest way to get the HTTP dashboard working without OAuth - no credentials are needed, so any malicious website can silently read, modify, and delete all stored memories. This issue has been patched in version 10.25.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | mcp-memory-service | 10.25.1 | GHSA-g9rg-8vq5-mpwm |
| PyPI | mcp-memory-service | 10.25.1 | PYSEC-2026-2625 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| doobidoo | mcp-memory-service | < 10.25.1 |
Weakness: CWE-942 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N