CVE-2026-44830 Details
Description
Nocturne Memory is a lightweight, rollbackable, and visual Long-Term Memory Server for MCP Agents. Prior to 2.4.1, when API_TOKEN is unset or empty, the BearerTokenAuthMiddleware bypasses authentication for all HTTP requests. Combined with the default 0.0.0.0 host binding and CORS allow_origins=["*"], operators following the Docker setup without explicitly setting API_TOKEN expose the full Knowledge-Graph read/write API to any LAN-reachable client. An attacker on the same network can read, write, or delete all memory entries — including system://boot and core://* URIs that auto-load into downstream agent sessions, enabling persistent prompt-injection. This vulnerability is fixed in 2.4.1.
An authentication bypass vulnerability has been identified in Nocturne Memory versions prior to 2.4.1. When the API_TOKEN is unset or empty, the BearerTokenAuthMiddleware allows unauthorized access to all HTTP requests. This issue is compounded by the default host binding of 0.0.0.0 and permissive CORS settings, which together expose the full Knowledge-Graph read/write API to any client on the same local network. As a result, an attacker can read, write, or delete all memory entries, including critical system URIs that could enable persistent prompt-injection in downstream agent sessions.
Users are advised to upgrade to Nocturne Memory version 2.4.1 or later. After upgrading, ensure to set a secure API_TOKEN of at least 32 characters, update MCP client configurations to include the Authorization header with the token, and verify that the application is not bound to 0.0.0.0.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 27, 2026CISA-ADP
Assessed May 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Dataojitori/nocturne_memory/security/advisories/GHSA-crr4-xrj9-ww8g | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Dataojitori Nocturne Memory | <= 2.4.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |