How severe is CVE-2026-33010?

CVE-2026-33010 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability none.

Is CVE-2026-33010 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (31st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-33010?

CVE-2026-33010 affects Doobidoo Mcp-memory-service. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-33010?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2026-33010 have an EU (EUVD) identifier?

Yes. CVE-2026-33010 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-13766.

When was CVE-2026-33010 published?

CVE-2026-33010 was published on 2026-03-20 and last updated on 2026-06-17.

CVE-2026-33010

CVE-2026-33010 is a high-severity vulnerability in Doobidoo Mcp-memory-service with a CVSS 3.x base score of 8.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-942.

Key facts

Severity: High (CVSS 3.x base score 8.1)
EPSS exploit prediction: 0% (31st percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-13766
Weakness: CWE-942
Affected product: Doobidoo Mcp-memory-service
Published: 2026-03-20
Last modified: 2026-06-17

Description

mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.25.1, when the HTTP server is enabled (MCP_HTTP_ENABLED=true), the application configures FastAPI's CORSMiddleware with allow_origins=['*'], allow_credentials=True, allow_methods=["*"], and allow_headers=["*"]. The wildcard Access-Control-Allow-Origin: * header permits any website to read API responses cross-origin. When combined with anonymous access (MCP_ALLOW_ANONYMOUS_ACCESS=true) - the simplest way to get the HTTP dashboard working without OAuth - no credentials are needed, so any malicious website can silently read, modify, and delete all stored memories. This issue has been patched in version 10.25.1.

Frequently asked questions

What is CVE-2026-33010?: mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.25.1, when the HTTP server is enabled (MCP_HTTP_ENABLED=true), the application configures FastAPI's CORSMiddleware with allow_origins=['*'], allow_credentials=True, allow_methods=["*"], and allow_headers=["*"]. The wildcard Access-Control-Allow-Origin: * header permits any website to read API responses cross-origin. When combined with anonymous access (MCP_ALLOW_ANONYMOUS_ACCESS=true) - the simplest way to get the HTTP dashboard working without OAuth - no credentials are needed, so any malicious website can silently read, modify, and delete all stored memories. This issue has been patched in version 10.25.1.
How severe is CVE-2026-33010?: CVE-2026-33010 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability none.
Is CVE-2026-33010 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (31st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-33010?: CVE-2026-33010 affects Doobidoo Mcp-memory-service. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-33010?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-33010 have an EU (EUVD) identifier?: Yes. CVE-2026-33010 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-13766.
When was CVE-2026-33010 published?: CVE-2026-33010 was published on 2026-03-20 and last updated on 2026-06-17.

References

https://github.com/doobidoo/mcp-memory-service/security/advisories/GHSA-g9rg-8vq5-mpwm

Affected products (1)

cpe:2.3:a:doobidoo:mcp-memory-service:*:*:*:*:*:*:*:*

More vulnerabilities in Doobidoo Mcp-memory-service

CVE-2026-29787 — Medium (CVSS 5.3): mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.21.0, the…

All CVEs affecting Doobidoo Mcp-memory-service →

Other CWE-942 vulnerabilities

CVE-2022-26969 — Critical (CVSS 9.8): In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.
CVE-2022-31736 — Critical (CVSS 9.8): A malicious website could have learned the size of a cross-origin resource that supported Range requests. This…
CVE-2026-34449 — Critical (CVSS 9.6): SiYuan is a personal knowledge management system. Prior to version 3.6.2, a malicious website can achieve Remote Code…
CVE-2026-30924 — Critical (CVSS 9.6): qui is a web interface for managing qBittorrent instances. Versions 1.14.1 and below use a permissive CORS policy that…
CVE-2026-9739 — Critical (CVSS 9.4): Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented…
CVE-2026-8948 — Critical (CVSS 9.1): Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151 and Thunderbird…

Browse all CWE-942 vulnerabilities →