CVE-2026-33010
Doobidoo Mcp-Memory-Service ≤ 10.25.1
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NSummary
CVE-2026-33010 is a high-severity Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942) vulnerability in Doobidoo Mcp-Memory-Service. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 32th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the Privacy and Disclosure risk domain.
The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and SC-7 (Boundary Protection) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-33010 is a cross-origin resource sharing (CORS) misconfiguration vulnerability in mcp-memory-service, an open-source memory backend for multi-agent systems. In versions prior to 10.25.1, when the HTTP server is enabled via MCP_HTTP_ENABLED=true, the application sets FastAPI's CORSMiddleware with overly permissive settings: allow_origins=['*'], allow_credentials=True, allow_methods=["*"], and allow_headers=["*"]. This allows any website to perform cross-origin requests to the API. The vulnerability is rated 8.1 on the CVSS v3.1 scale (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) and is associated with CWE-942.
An attacker can exploit this by hosting a malicious website that a target user visits. If the victim's mcp-memory-service instance also has anonymous access enabled (MCP_ALLOW_ANONYMOUS_ACCESS=true), which is a common setup for the HTTP dashboard without OAuth, the malicious site can silently send cross-origin requests to the service. No credentials are required, enabling the attacker to read, modify, or delete all stored memories in the backend.
The vulnerability has been patched in mcp-memory-service version 10.25.1. Additional details on the fix and remediation are available in the GitHub security advisory at https://github.com/doobidoo/mcp-memory-service/security/advisories/GHSA-g9rg-8vq5-mpwm.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13766
Vulnerability Data
mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.25.1, when the HTTP server is enabled (MCP_HTTP_ENABLED=true), the application configures FastAPI's CORSMiddleware with allow_origins=['*'], allow_credentials=True, allow_methods=["*"], and allow_headers=["*"]. The wildcard Access-Control-Allow-Origin: * header permits any website to…
more
read API responses cross-origin. When combined with anonymous access (MCP_ALLOW_ANONYMOUS_ACCESS=true) - the simplest way to get the HTTP dashboard working without OAuth - no credentials are needed, so any malicious website can silently read, modify, and delete all stored memories. This issue has been patched in version 10.25.1.
- CWE(s)
AI Security AnalysisAI
- AI Category
- AI Agent Protocols and Integrations
- Risk Domain
- Privacy and Disclosure
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: mcp
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.4.3V3.4.6V3.5.2
Mitigating Controls (NIST 800-53 r5) AI
Information flow enforcement requires approved authorizations and would reject policies permitting untrusted domains.
Boundary protection at external interfaces stops unauthorized cross-domain communication allowed by permissive policies.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardened configuration baselines and reviews directly prevent permissive CSP or cross-domain policies.
Secure SDLC activities include review and testing of web security policies to avoid untrusted domains.
Vulnerability identification processes can surface permissive policy misconfigurations.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect overly permissive cross-domain policies but does not prevent their initial introduction.
Network security policies can restrict cross-domain communication but do not specifically mandate strict CSP or cross-domain policy configuration.
Security of network services includes defining allowed endpoints, which can limit untrusted domains but does not directly address web-client policy files.
Web filtering can block untrusted domains at the network level, partially mitigating permissive cross-domain policies.
Application security requirements should specify secure CSP and cross-domain policy settings, directly addressing the weakness.
Secure architecture principles include defining trust boundaries, which can reduce permissive cross-domain allowances.