# CVE-2026-49291: mcp-memory-service β€” Fixed in 10.65.3 🐍 🐍 PyPI Not in CISA KEV HIGH severity # CVE-2026-49291 β€” mcp-memory-service HIGH CVE-2026-49291 is a high-severity (CVSS 8.1) CWE-862 vulnerability in mcp-memory-service. A fix is available for mcp-memory-service β€” see the affected versions and patch details below. mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call Also known as[GHSA-2r68-g678-7qr3](/vulnerability/GHSA-2r68-g678-7qr3)PYSEC-2026-2622 Published Jun 19, 2026 Updated Oct 28, 2026 Affected 1 pkg Patched 1 / 1 Exploits None indexed Exploitation data as of Nov 8, 2026 Β· OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### No confirmed exploitation observed yet - A successful exploit gives an attacker total control of the affected component, not partial access. - CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-49291. ## EPSS Exploitation Probability [via FIRST.org β†—](https://www.first.org/epss/) 0.5%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs42th percentile β€” riskier than 42% of all scored CVEsHighest risk 0.00%0.33%0.66%0.99%0.3%0.5%Jul 26Oct 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 1 pkg affected 🐍`mcp-memory-service` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages β€” download data is not available via public APIs for these ecosystems. ## Description ### Summary The HTTP MCP JSON-RPC endpoint at `/mcp` requires only OAuth `read` scope for all requests, then dispatches `tools/call` directly to handlers that include mutating tools. A read-only OAuth client can call `store_memory` and `delete_memory` through MCP even though the corresponding REST endpoints require `write` scope. ### Technical Details `src/mcp_memory_service/web/api/mcp.py` declares `mcp_endpoint` with `user: AuthenticationResult = Depends(require_read_access)`. For `tools/call`, it extracts the requested tool name and arguments, then calls `handle_tool_call(storage, tool_name, arguments)` without passing the authenticated user or checking a per-tool required scope. The MCP tool registry includes both read tools and write tools. In the same handler file, `store_memory` creates a `Memory` object and calls `storage.store(...)`, while `delete_memory` calls `storage.delete(content_hash)`. These operations are reachable with only the `read` scope. The REST endpoint demonstrates the intended boundary: `POST /api/memories` uses `Depends(require_write_access)` and rejects a read-only token with 403 `insufficient_scope`. ### Reproduction 1. Enable OAuth and disable anonymous access. 2. Generate a valid OAuth JWT with only `scope: read`. 3. Confirm the REST write endpoint rejects it: ``` POST /api/memories Authorization: Bearer Content-Type: application/json {"content":"rest denied control"} ``` Expected and observed: HTTP 403 with `Required scope 'write' not granted`. 1. Send the same read-only token to the MCP endpoint: ``` POST /mcp Authorization: Bearer Content-Type: application/json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "store_memory", "arguments": { "content": "mcp read scope stored this", "tags": ["poc"] } } } ``` Observed: HTTP 200 JSON-RPC success and the storage `store` sink is reached. 1. A read-only token can also call `delete_memory` through MCP if it knows a content hash: ``` POST /mcp Authorization: Bearer Content-Type: application/json { "jsonrpc": "2.0", "id": 2, "method": "tools/call", "params": { "name": "delete_memory", "arguments": {"content_hash": ""} } } ``` Observed: HTTP 200 JSON-RPC success and the storage `delete` sink is reached. ### Impact A client intended to be read-only can inject or delete memories through the MCP API. This can corrupt the memory database, influence future agent context, and destroy stored user memories without the OAuth `write` scope required by the REST API. ### Affected Versions Confirmed present on current main commit `c99a922477df41f75a44db11182ae48a57311910` and latest release tag `v10.65.0` (`4eb4a62665589f9dd9f8c393afa32de434b4098a`). ### Suggested Fix Enforce authorization per MCP tool at `tools/call` time. Require `write` for `store_memory` and `delete_memory`, keep `read` only for read-only tools, and add regression tests proving direct `tools/call` to mutating tools is rejected before the handler reaches storage when the caller has only `read` scope. ## Affected Packages 1 total 1 fixed Ecosystem Package Vulnerable range Fix 🐍PyPI `mcp-memory-service` all versions 10.65.3`pip install --upgrade 'mcp-memory-service==10.65.3'` ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for mcp-memory-service, including transitive dependencies β€” a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update mcp-memory-service to 10.65.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range β€” O3 confirms CVE-2026-49291 is resolved across your whole dependency graph. 3. ### Workarounds Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used. ## Frequently Asked Questions \## Summary The HTTP MCP JSON-RPC endpoint at \`/mcp\` requires only OAuth \`read\` scope for all requests, then dispatches \`tools/call\` directly to handlers that include mutating tools. A read-only OAuth client can call \`store\_memory\` and \`delete\_memory\` through MCP even though the corresponding REST endpoints require \`write\` scope. ## Technical Details \`src/mcp\_memory\_service/web/api/mcp.py\` declares \`mcp\_endpoint\` with \`user: AuthenticationResult = Depends(require\_read\_access)\`. For \`tools/call\`, it extracts the requested tool name and arguments, then calls \`handle\_tool\_call(storage, tool\_nam O3 Security Β· Impact-Aware SCA ### Is CVE-2026-49291 in your dependencies? Find it across PyPI, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)