CVE-2026-44830 Overview
CVE-2026-44830 is an authentication bypass vulnerability in Nocturne Memory, a Long-Term Memory Server for Model Context Protocol (MCP) Agents. The flaw exists in the BearerTokenAuthMiddleware component in versions prior to 2.4.1. When the API_TOKEN environment variable is unset or empty, the middleware silently bypasses authentication for all HTTP requests. Combined with the default 0.0.0.0 host binding and permissive CORS allow_origins=["*"] configuration, operators following the Docker setup without explicitly setting API_TOKEN expose the full Knowledge-Graph read/write API to any client on the local network. The vulnerability is tracked under [CWE-306] Missing Authentication for Critical Function.
Critical Impact
An adjacent-network attacker can read, write, or delete all memory entries — including system://boot and core://* URIs that auto-load into downstream agent sessions, enabling persistent prompt-injection attacks.
Affected Products
- Nocturne Memory versions prior to 2.4.1
- Docker deployments using default configuration without API_TOKEN set
- MCP Agent environments consuming the exposed Knowledge-Graph API
Discovery Timeline
- 2026-05-27 - CVE-2026-44830 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-44830
Vulnerability Analysis
The vulnerability stems from how BearerTokenAuthMiddleware validates incoming HTTP requests. When API_TOKEN is unset or empty, the middleware treats this state as a permissive condition and forwards requests without authentication checks. Operators deploying Nocturne Memory via the documented Docker workflow inherit this default state unless they explicitly assign an API_TOKEN value.
The authentication weakness compounds with two additional default settings. The server binds to 0.0.0.0, exposing it on all network interfaces. The CORS policy uses allow_origins=["*"], accepting requests from any origin. Together these defaults reachable from any host on the same LAN segment.
Attackers with adjacent network access gain full read, write, and delete access to the Knowledge-Graph API. The most consequential targets are system://boot and core://* Uniform Resource Identifiers (URIs). These entries auto-load into downstream agent sessions, allowing an attacker to plant persistent prompt-injection payloads that execute across every subsequent interaction with the MCP agent.
Root Cause
The root cause is a missing authentication check (CWE-306). The middleware fails to enforce a deny-by-default policy when the credential material is absent. An empty or unset token should reject all requests rather than disable enforcement.
Attack Vector
Exploitation requires only network adjacency. An attacker on the same LAN sends unauthenticated HTTP requests to the Nocturne Memory endpoint. Writing crafted payloads to system://boot or core://* URIs achieves persistent prompt injection in any agent session that subsequently loads those entries. Refer to the GitHub Security Advisory GHSA-crr4-xrj9-ww8g for protocol-level details.
Detection Methods for CVE-2026-44830
Indicators of Compromise
- Unauthenticated HTTP requests to Nocturne Memory API endpoints originating from unexpected LAN hosts
- Unexpected writes or deletions on system://boot or core://* Knowledge-Graph entries
- Container runtime configurations exposing Nocturne Memory on 0.0.0.0 with no API_TOKEN environment variable defined
Detection Strategies
- Audit running containers and Kubernetes manifests for Nocturne Memory images with missing or empty API_TOKEN values
- Inspect HTTP access logs for write or delete operations against Knowledge-Graph URIs from non-administrative sources
- Compare current Knowledge-Graph contents against known-good baselines to surface tampered core://* entries
Monitoring Recommendations
- Continuously monitor MCP agent sessions for anomalous instructions sourced from auto-loaded memory entries
- Alert on any HTTP traffic to the Nocturne Memory port from outside an allow-listed management subnet
- Track changes to environment variables and Docker Compose files governing Nocturne Memory deployments
How to Mitigate CVE-2026-44830
Immediate Actions Required
- Upgrade Nocturne Memory to version 2.4.1 or later, which addresses the authentication bypass
- Set a strong, unique API_TOKEN value in every deployment environment before exposing the service
- Restrict the listener to 127.0.0.1 or a trusted internal interface instead of 0.0.0.0 where possible
- Audit existing Knowledge-Graph entries for malicious payloads in system://boot and core://* URIs and remove them
Patch Information
The vulnerability is fixed in Nocturne Memory 2.4.1. The fix corrects BearerTokenAuthMiddleware to reject requests when API_TOKEN is unset or empty. Upgrade instructions and release notes are available in the GitHub Security Advisory GHSA-crr4-xrj9-ww8g.
Workarounds
- Place Nocturne Memory behind a reverse proxy that enforces authentication and IP allow-listing
- Tighten the CORS policy to an explicit list of trusted origins instead of the wildcard *
- Use network segmentation or host firewall rules to limit access to the API port to administrative hosts only
# Configuration example: set a strong token and restrict bind address
export API_TOKEN="$(openssl rand -hex 32)"
export HOST="127.0.0.1"
docker run -e API_TOKEN -e HOST -p 127.0.0.1:8000:8000 nocturne_memory:2.4.1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
