doobidoo mcp-memory-service up to 10.25.0 HTTP Dashboard cross-domain policy

Summaryinfo

A vulnerability, which was classified as critical, was found in doobidoo mcp-memory-service up to 10.25.0. The affected element is an unknown function of the component HTTP Dashboard. The manipulation results in cross-domain policy. This vulnerability is identified as CVE-2026-33010. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in doobidoo mcp-memory-service up to 10.25.0. Affected is some unknown functionality of the component HTTP Dashboard. The manipulation with an unknown input leads to a cross-domain policy vulnerability. CWE is classifying the issue as CWE-942. The product uses a cross-domain policy file that includes domains that should not be trusted. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.25.1, when the HTTP server is enabled (MCP_HTTP_ENABLED=true), the application configures FastAPI's CORSMiddleware with allow_origins=['*'], allow_credentials=True, allow_methods=["*"], and allow_headers=["*"]. The wildcard Access-Control-Allow-Origin: * header permits any website to read API responses cross-origin. When combined with anonymous access (MCP_ALLOW_ANONYMOUS_ACCESS=true) - the simplest way to get the HTTP dashboard working without OAuth - no credentials are needed, so any malicious website can silently read, modify, and delete all stored memories. This issue has been patched in version 10.25.1.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-33010 since 03/17/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

Upgrading to version 10.25.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-13766). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• doobidoo

Name

• mcp-memory-service

Version

• 10.0
• 10.1
• 10.2
• 10.3
• 10.4
• 10.5
• 10.6
• 10.7
• 10.8
• 10.9
• 10.10
• 10.11
• 10.12
• 10.13
• 10.14
• 10.15
• 10.16
• 10.17
• 10.18
• 10.19
• 10.20
• 10.21
• 10.22
• 10.23
• 10.24
• 10.25.0

Website

• Product: https://github.com/doobidoo/mcp-memory-service/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion