Executive brief
mcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theft
Affected products
- PyPI mcp-memory-service
Junglewise Threat Intelligence
CVE-2026-33010: PYSEC-2026-2625 - mcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theft
CVE-2026-33010 · Severity: low · CVSS 3.1 · Published 2026-07-13
Technologies: mcp-memory-service (PyPI). Vendors: PyPI.
Related threats
- mcp-memory-service is a semantic memory layer for AI applications. Prior to 10.67.1, all HTTP routes under /api/documents/* in mcp-memory-se
- PYSEC-2026-2623 - mcp-memory-service Vulnerable to System Information Disclosure via Health Endpoint
- doobidoo mcp-memory-service authorization bypass in JSON-RPC endpoint