Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-33010

mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.25.1, when the HTTP server is enabled (MCP_HTTP_ENABLED=true), the application configures FastAPI's CORSMiddleware with allow_origins=['*'], allow_credentials=True, allow_methods=["*"], and allow_headers=["*"]. The wildcard Access-Control-Allow-Origin: * header permits any website to read API responses cross-origin. When combined with anonymous access (MCP_ALLOW_ANONYMOUS_ACCESS=true) - the simplest way to get the HTTP dashboard working without OAuth - no credentials are needed, so any malicious website can silently read, modify, and delete all stored memories. This issue has been patched in version 10.25.1.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 9.3%
CVSS Severity
CVSS v3 Score 8.1
Products affected by CVE-2026-33010


Contact Us

Shodan ® - All rights reserved