CVE-2026-29787 Details
Description
mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.21.0, the /api/health/detailed endpoint returns detailed system information including OS version, Python version, CPU count, memory totals, disk usage, and the full database filesystem path. When MCP_ALLOW_ANONYMOUS_ACCESS=true is set (required for the HTTP server to function without OAuth/API key), this endpoint is accessible without authentication. Combined with the default 0.0.0.0 binding, this exposes sensitive reconnaissance data to the entire network. This issue has been patched in version 10.21.0.
A vulnerability in mcp-memory-service's health endpoint allows for unauthorized access to sensitive system information. The issue arises when 'MCP_ALLOW_ANONYMOUS_ACCESS=true' is set, enabling anonymous access without authentication. The '/api/health/detailed' endpoint, which is supposed to provide detailed system information, is accessible to unauthenticated users. This endpoint leaks data such as the OS version, Python version, CPU count, memory totals, disk usage, and the full database filesystem path. The vulnerability is compounded by the default server binding to '0.0.0.0', exposing this sensitive information to the entire network. The issue affects all versions through 10.17.16 and has been patched in version 10.21.0.
The vulnerability has been addressed in version 10.21.0 of mcp-memory-service. Users should update to this version to mitigate the issue. For those who cannot update, it is recommended to disable anonymous access and bind the server to '127.0.0.1' to prevent exposure of sensitive information.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/doobidoo/mcp-memory-service/commit/18f4323ca92763196aa2922f691dfbeb6bd84e48 | [email protected] | Patch |
| https://github.com/doobidoo/mcp-memory-service/security/advisories/GHSA-73hc-m4hx-79pj | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| doobidoo mcp-memory-service | < 10.21.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 11, 2026 | Initial Analysis | [email protected] |
| Mar 7, 2026 | New CVE Received | [email protected] |