CVE-2026-54561: MCP Memory Keeper Path Traversal Vulnerability

CVE-2026-54561 Overview

CVE-2026-54561 is a path traversal vulnerability [CWE-22] in MCP Memory Keeper, a Model Context Protocol (MCP) server that provides persistent context management for AI coding assistants. Versions prior to 0.13.0 accept a caller-controlled filePath argument in the context_import tool and pass it directly to fs.readFileSync without restricting reads to an export directory. An MCP client, including an induced large language model (LLM) agent, can supply ../ traversal sequences or absolute paths to read arbitrary files accessible to the server process. The issue is fixed in version 0.13.0.

Critical Impact
Attackers can read local files including JSON credentials, service-account files, environment configuration, and portions of SSH keys through the MCP server process.

Affected Products

MCP Memory Keeper versions prior to 0.13.0
The vulnerable code resides in src/index.ts within the context_import tool handler
Any AI coding assistant integration relying on the affected MCP server

Discovery Timeline

2026-09-15 - CVE-2026-54561 published to the National Vulnerability Database (NVD)
2026-09-15 - Last updated in NVD database
Fix released in MCP Memory Keeper v0.13.0
Coordinated through GitHub Security Advisory GHSA-f7wf-v2vw-mpcx

Technical Details for CVE-2026-54561

Vulnerability Analysis

The context_import tool in src/index.ts accepts a filePath string from the MCP client and forwards it to fs.readFileSync with no canonicalization or allowlist check. The server process reads whatever file the supplied path resolves to, then attempts to parse the contents as JSON. Two disclosure modes result from this behavior.

In the first mode, a valid JSON file is parsed successfully and imported into the caller's session. The attacker then retrieves the full contents through context_get or context_export. This exposes other exported sessions, JSON credential files, cloud service-account keys, and configuration blobs.

In the second mode, non-JSON files trigger a JSON.parse error. The resulting SyntaxError message includes leading bytes from the target file, leaking fragments of environment files, SSH private keys, and other sensitive local content back to the caller.

Root Cause

The root cause is missing input validation on a filesystem path [CWE-22]. The handler treats the caller-supplied filePath as trusted and performs no restriction to an export directory, no rejection of absolute paths, and no resolution check against a base directory.

Attack Vector

Exploitation requires local access to the MCP server through an MCP client session. Any MCP client, or an LLM agent that can be prompt-injected into invoking context_import, can supply a traversal path such as ../../etc/passwd or an absolute path to ~/.ssh/id_rsa. No authentication or user interaction is required beyond the ability to issue tool calls to the server.

Refer to the GitHub Security Advisory GHSA-f7wf-v2vw-mpcx and the remediation commits for the exact code path and fix.

Detection Methods for CVE-2026-54561

Indicators of Compromise

MCP server logs showing context_import calls with filePath values containing ../ sequences or absolute paths outside the designated export directory.
Unexpected SyntaxError messages generated by JSON.parse inside the MCP Memory Keeper process, indicating attempts to import non-JSON files.
Session contents retrieved via context_get or context_export that contain credentials, private keys, or environment variables the session did not legitimately create.

Detection Strategies

Audit MCP tool invocations for context_import arguments referencing sensitive paths such as /etc/, ~/.ssh/, .env, or cloud credential files.
Correlate LLM agent prompts with subsequent context_import calls to identify prompt injection driving tool abuse.
Monitor the MCP server process for file reads outside its expected working directories using host-based filesystem telemetry.

Monitoring Recommendations

Enable verbose logging of all MCP tool calls, including argument values, and forward logs to a centralized analytics platform for review.
Alert on any read access by the MCP server process to files matching credential, key, or environment-file patterns.
Track the installed version of mcp-memory-keeper across developer workstations and CI environments to identify hosts still running versions prior to 0.13.0.

How to Mitigate CVE-2026-54561

Immediate Actions Required

Upgrade MCP Memory Keeper to version 0.13.0 or later on every host where the server is installed.
Rotate any credentials, service-account keys, SSH keys, or API tokens that were readable by the MCP server process on affected systems.
Review historical session exports for evidence of unauthorized file contents imported through context_import.

Patch Information

The fix is available in MCP Memory Keeper v0.13.0. The remediation is delivered through commits 58640c22, b9369568, and e0ab521a, tracked in Issue #35 and Pull Request #36.

Workarounds

Run the MCP server under a dedicated low-privilege user account that cannot read credential files, SSH keys, or environment configuration owned by other users.
Restrict the server process with mandatory access controls or filesystem sandboxing so it can only read within a designated export directory.
Disable the context_import tool in MCP client configuration until the upgrade to 0.13.0 is deployed.

bash

# Configuration example
npm install mcp-memory-keeper@0.13.0