CVE-2026-112157 in memmy-agent
Summary
by MITRE • 10/19/2026
A weakness has been identified in MemTensor memmy-agent up to 1.0.9/1.1.1/1.2.2. The impacted element is the function requireAdminWrite of the file Memory/src/server/http.ts of the component Memory Service. This manipulation causes resource consumption. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is regarded as difficult. The exploit has been made available to the public and could be used for attacks. The exploit is partially overstated. While "POST /api/v1/admin/shutdown" accepts unauthenticated requests when no token is configured, it’s designed for local use and later received cross-origin fixes. Unauthenticated endpoint exposure is confirmed; browser-triggered DoS remains likely but depends on specific browser behavior.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in MemTensor memmy-agent versions up to 1.0.9, 1.1.1, and 1.2.2 centers on a critical flaw within the Memory Service component, specifically located in the requireAdminWrite function of the file Memory/src/server/http.ts. This architectural weakness allows for unauthenticated access to administrative endpoints under specific configuration conditions where no authentication token is enforced. The core technical issue manifests as excessive resource consumption when these unprotected endpoints are manipulated by remote actors. While the initial assessment suggests a high complexity and difficult exploitability due to the need for precise timing or specific environmental configurations, the existence of public exploits indicates that attackers have successfully simplified this process in practice. This discrepancy highlights the importance of verifying theoretical complexity against real-world exploitation capabilities, as documented security advisories often underestimate the ease with which certain conditions can be met by determined adversaries utilizing automated tooling.
From a technical perspective, the flaw permits remote actors to send requests to administrative interfaces without valid credentials, leading to denial-of-service scenarios through resource exhaustion. The specific endpoint POST /api/v1/admin/shutdown is highlighted as accepting unauthenticated requests when authentication is disabled in the configuration. Although this endpoint was originally designed for local management purposes and subsequently received cross-origin request policy fixes, it remains exposed if the underlying application logic does not strictly enforce access controls before processing administrative commands. This exposure aligns with CWE-284 Improper Access Control and CWE-770 Allocation of Resources Without Limits or Throttling, as the system fails to restrict who can trigger resource-intensive operations and lacks adequate safeguards against rapid repeated requests that deplete system capacity.
The operational impact of this vulnerability is significant for any deployment where MemTensor memmy-agent is configured without strict authentication measures on administrative ports. An attacker leveraging public exploits can induce a denial-of-service condition, rendering the service unavailable to legitimate users. The complexity of exploitation is rated as high because it may require specific browser behaviors or precise network conditions to trigger effectively, particularly regarding cross-origin resource sharing restrictions that might mitigate some automated attack vectors in standard web contexts. However, the fact that an exploit has been made publicly available suggests that these barriers are not insurmountable for attackers with sufficient technical expertise and persistence. The partial overstating of the threat level in initial reports underscores the need for security teams to conduct their own risk assessments rather than relying solely on vendor severity ratings.
Mitigation strategies must prioritize immediate remediation through configuration hardening and software updates. Administrators should ensure that authentication tokens are strictly configured and enforced for all administrative endpoints, particularly those handling sensitive operations like shutdown or system reconfiguration. Upgrading MemTensor memmy-agent to a version beyond 1.2.2 is essential if such patches address the underlying access control logic in the requireAdminWrite function. Additionally, implementing network-level controls such as firewalls that restrict access to administrative interfaces to trusted IP addresses only can provide an effective layer of defense against remote exploitation. Security teams should also monitor for unusual spikes in resource consumption or repeated failed authentication attempts which may indicate probing activity targeting this vulnerability. Aligning these defenses with MITRE ATT&CK techniques related to Initial Access and Impact, specifically T1078 Valid Accounts if credentials are compromised or T1499 Endpoint Denial of Service via resource exhaustion, will help maintain resilience against both current and emerging threats exploiting similar architectural weaknesses in web-based management interfaces.