CVE-2026-49291: MCP Memory Service Auth Bypass Flaw

CVE-2026-49291 Overview

CVE-2026-49291 is a missing authorization vulnerability [CWE-862] in mcp-memory-service, a semantic memory layer used by AI applications. The HTTP MCP JSON-RPC endpoint at /mcp requires only the OAuth read scope for all requests. The endpoint then dispatches tools/call directly to handlers that include mutating tools. A read-only OAuth client can invoke store_memory and delete_memory through MCP, even though the equivalent REST endpoints require the write scope. Version 10.65.3 addresses the issue.

Critical Impact
A read-only OAuth client can write to and delete data from the memory store, breaking integrity and availability guarantees for AI applications relying on this service.

Affected Products

mcp-memory-service versions prior to 10.65.3
HTTP MCP JSON-RPC endpoint at /mcp
AI applications integrating mcp-memory-service for semantic memory storage

Discovery Timeline

2026-06-19 - CVE-2026-49291 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-49291

Vulnerability Analysis

The flaw is a server-side authorization gap in the MCP JSON-RPC transport. The REST API correctly distinguishes read and write scopes on a per-endpoint basis. The /mcp endpoint does not enforce that distinction. It validates only the read scope and then routes tools/call requests to tool handlers without re-checking scope against the tool's intended operation.

Mutating tools such as store_memory and delete_memory are reachable from this dispatch path. A client holding a token issued for read-only access can therefore modify or remove memory entries. The bug breaks the principle of least privilege between the two transports exposed by the same service.

Root Cause

The root cause is a missing authorization check on tool dispatch [CWE-862]. The MCP handler treats all tools/call operations as read-class requests. It does not consult a per-tool scope map before invoking the handler. The REST surface enforces scopes correctly, which creates an inconsistent authorization model across transports.

Attack Vector

An attacker needs network access to the /mcp endpoint and a valid OAuth token with the read scope. The attacker sends a JSON-RPC tools/call request naming a mutating tool such as store_memory or delete_memory. The server accepts the request and executes the mutation. No user interaction is required. The vulnerability affects integrity and availability of stored memory but does not directly leak data confidentiality.

For technical details, see the GitHub Security Advisory GHSA-2r68-g678-7qr3.

Detection Methods for CVE-2026-49291

Indicators of Compromise

JSON-RPC tools/call requests to /mcp invoking store_memory or delete_memory from clients issued only read-scoped tokens.
Unexpected creations or deletions in the memory store that do not correlate with REST write-scoped API calls.
OAuth audit log entries showing read-only clients producing state changes in the backing store.

Detection Strategies

Correlate OAuth token scope claims with the tool name in tools/call payloads on /mcp and alert when a read-only token invokes a mutating tool.
Compare REST write activity to MCP tool activity for the same principal and flag divergence.
Hash and version memory records to identify unauthorized modifications or deletions over time.

Monitoring Recommendations

Enable verbose request logging on /mcp, including JSON-RPC method, tool name, and the authenticated subject and scope.
Forward OAuth issuer logs and mcp-memory-service access logs to a centralized SIEM for correlation.
Track the running version of mcp-memory-service in software inventory and alert on any host running a version earlier than 10.65.3.

How to Mitigate CVE-2026-49291

Immediate Actions Required

Upgrade mcp-memory-service to version 10.65.3 or later from PyPI.
Audit OAuth clients and tokens authorized against the service and revoke tokens that no longer require access.
Review recent memory store activity for unauthorized store_memory or delete_memory operations.

Patch Information

The maintainer released version 10.65.3, which enforces scope checks for mutating tools dispatched through the /mcp JSON-RPC endpoint. Operators should pin to >=10.65.3. Refer to the GitHub Security Advisory for full remediation details.

Workarounds

Restrict network access to /mcp to trusted internal clients until the upgrade is applied.
Issue OAuth tokens with the write scope only to clients that strictly require mutation, and treat any read token as potentially capable of mutation until patched.
Place a reverse proxy in front of /mcp that inspects JSON-RPC payloads and blocks tools/call requests targeting store_memory and delete_memory from read-only principals.

bash

# Configuration example: upgrade mcp-memory-service to the patched version
pip install --upgrade 'mcp-memory-service>=10.65.3'
pip show mcp-memory-service | grep -i version