Executive brief
Nocturne Memory, a server used to store long-term memory for AI agents, contains a security flaw where authentication is completely disabled if a specific security token is not configured. Because the software also defaults to being accessible across the entire local network, an unauthorized person on the same network could read, modify, or delete all stored AI memories. This could allow an attacker to manipulate AI behavior or steal sensitive information stored in the agent's memory.
Technical details
A missing authentication vulnerability (CWE-306) exists in Nocturne Memory's BearerTokenAuthMiddleware. When the API_TOKEN environment variable is unset or empty, the middleware bypasses authentication checks for all HTTP requests. This is exacerbated by default configurations that bind the service to 0.0.0.0 and use permissive CORS settings (allow_origins=["*"]). An attacker on the same local network can perform full CRUD operations on the Knowledge-Graph API, including modifying system and core URIs to achieve persistent prompt injection in downstream AI agent sessions. The issue is resolved in version 2.4.1, which enforces a minimum token length and restricts default network bindings.
Affected products
- Dataojitori Nocturne Memory <= 2.4.0
Timeline
- 2026-05-05: advisory: GitHub Security Advisory published
- 2026-05-27: disclosed: CVE published to NVD