CVE-2026-29787: mcp-memory-service Vulnerable to System Information Disclosure via Health Endpoint
Summary
CVE-2026-29787: mcp-memory-service Vulnerable to System Information Disclosure via Health Endpoint. Affects mcp-memory-service versions < 10.21.0. Fixed in 10.21.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mcp-memory-service is an open-source service designed for memory management and storage. It provides various endpoints for health checks, data storage, and retrieval. However, it has a critical vulnerability that exposes sensitive system information through its health endpoint when configured to allow anonymous access.
Vulnerability Detail
The vulnerability arises from the '/api/health/detailed' endpoint, which returns detailed system information such as OS version, Python version, CPU count, memory totals, disk usage, and the full database filesystem path. When the configuration allows anonymous access, this endpoint becomes accessible without authentication, leading to potential information disclosure. Attackers can exploit this to gather reconnaissance data, which can be used for further attacks, including targeting known vulnerabilities based on the disclosed OS and software versions.
How To Fix
Minimum fixed version
10.21.0
This is the first release that contains the fix.
pip install --upgrade "mcp-memory-service==10.21.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can bind the service to '127.0.0.1' instead of '0.0.0.0' to prevent external access. This can be done by changing the configuration in config.py: 'HTTP_HOST = os.getenv('MCP_HTTP_HOST', '127.0.0.1')'. This will limit the exposure of the health endpoint to local requests only.
Conclusion
The mcp-memory-service has a significant vulnerability that can lead to system information disclosure. It is crucial to update to the patched version and implement recommended security measures to protect against potential exploitation.
See every vulnerability recorded for mcp-memory-service →
FAQ
The vulnerability allows unauthorized users to access sensitive system information, which can be used for targeted attacks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, implement the workaround by binding the service to '127.0.0.1' to limit exposure.
No, updating the package should not result in data loss, but it's always recommended to back up your data before making changes.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for mcp-memory-service.
