CVE-2026-49291

mcp-memory-service is a semantic memory layer for AI applications. Prior to version 10.65.3, the HTTP MCP JSON-RPC endpoint at "/mcp" requires only OAuth "read" scope for all requests, then dispatches "tools/call" directly to handlers that include mutating tools. A read-only OAuth client can call...

CVE-2026-49291: Missing Authorization

mcp-memory-service is a semantic memory layer for AI applications. Prior to version 10.65.3, the HTTP MCP JSON-RPC endpoint at /mcp requires only OAuth read scope for all requests, then dispatches tools/call directly to handlers that include mutating tools. A read-only OAuth client can call...