{"id":"CVE-2026-29787","aliases":["EUVD-2026-10165","GHSA-73hc-m4hx-79pj","PYSEC-2026-2623"],"status":"published","title":"mcp-memory-service: System Information Disclosure via Health Endpoint","description":"mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.21.0, the /api/health/detailed endpoint returns detailed system information including OS version, Python version, CPU count, memory totals, disk usage, and the full database filesystem path. When MCP_ALLOW_ANONYMOUS_ACCESS=true is set (required for the HTTP server to function without OAuth/API key), this endpoint is accessible without authentication. Combined with the default 0.0.0.0 binding, this exposes sensitive reconnaissance data to the entire network. This issue has been patched in version 10.21.0.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00411,"percentile":0.35688,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2026-03-05T21:42:10Z","modified":"2026-10-28T02:31:15Z","fixes":[{"ecosystem":"PyPI","package":"mcp-memory-service","fixed_in":["10.21.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"mcp-memory-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.21.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"mcp-memory-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.21.0"}]}],"versions":["10.0.0","10.0.1","10.0.2","10.0.3","10.1.0","10.1.1","10.1.2","10.10.0","10.10.1","10.10.2","10.10.3","10.10.4","10.10.5","10.10.6","10.11.0","10.11.1","10.11.2","10.12.0","10.12.1","10.13.0","10.13.1","10.13.2","10.14.0","10.15.0","10.15.1","10.16.0","10.16.1","10.17.0","10.17.10","10.17.12","10.17.13","10.17.14","10.17.15","10.17.16","10.17.2","10.17.3","10.17.4","10.17.5","10.17.6","10.17.7","10.17.8","10.17.9","10.18.0","10.18.1","10.18.2","10.18.3","10.19.0","10.2.0","10.2.1","10.20.0","10.20.1","10.20.2","10.20.4","10.20.5","10.20.6","10.3.0","10.4.0","10.4.1","10.4.2","10.4.3","10.4.4","10.4.5","10.4.6","10.5.0","10.5.1","10.6.0","10.6.1","10.7.0","10.7.1","10.7.2","10.8.0","10.9.0","8.24.0","8.25.1","8.25.2","8.26.0","8.27.0","8.27.1","8.27.2","8.28.0","8.28.1","8.29.0","8.30.0","8.31.0","8.32.0","8.33.0","8.34.0","8.35.0","8.36.0","8.36.1","8.37.0","8.38.0","8.38.1","8.39.0","8.39.1","8.40.0","8.41.0","8.41.1","8.41.2","8.42.0","8.42.1","8.43.0","8.44.0","8.45.0","8.45.1","8.45.2","8.45.3","8.46.0","8.46.1","8.46.2","8.46.3","8.47.0","8.47.1","8.48.0","8.48.1","8.48.2","8.48.3","8.48.4","8.49.0","8.50.0","8.50.1","8.51.0","8.52.0","8.52.1","8.52.2","8.53.0","8.54.0","8.54.1","8.54.2","8.54.3","8.54.4","8.55.0","8.57.1","8.58.0","8.59.0","8.60.0","8.61.0","8.61.1","8.61.2","8.62.0","8.62.1","8.62.10","8.62.11","8.62.12","8.62.13","8.62.2","8.62.3","8.62.4","8.62.5","8.62.6","8.62.7","8.62.8","8.62.9","8.63.0","8.63.1","8.64.0","8.65.0","8.66.0","8.67.0","8.68.0","8.68.1","8.68.2","8.69.0","8.70.0","8.71.0","8.72.0","8.73.0","8.74.0","8.75.0","8.75.1","8.76.0","9.0.0","9.0.1","9.0.2","9.0.3","9.0.4","9.0.5","9.0.6","9.2.0","9.2.1","9.3.1"]},{"source":"osv","ecosystem":"PyPI","package":"mcp-memory-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.21.0"}]}],"versions":["10.0.0","10.0.1","10.0.2","10.0.3","10.1.0","10.1.1","10.1.2","10.10.0","10.10.1","10.10.2","10.10.3","10.10.4","10.10.5","10.10.6","10.11.0","10.11.1","10.11.2","10.12.0","10.12.1","10.13.0","10.13.1","10.13.2","10.14.0","10.15.0","10.15.1","10.16.0","10.16.1","10.17.0","10.17.10","10.17.12","10.17.13","10.17.14","10.17.15","10.17.16","10.17.2","10.17.3","10.17.4","10.17.5","10.17.6","10.17.7","10.17.8","10.17.9","10.18.0","10.18.1","10.18.2","10.18.3","10.19.0","10.2.0","10.2.1","10.20.0","10.20.1","10.20.2","10.20.4","10.20.5","10.20.6","10.3.0","10.4.0","10.4.1","10.4.2","10.4.3","10.4.4","10.4.5","10.4.6","10.5.0","10.5.1","10.6.0","10.6.1","10.7.0","10.7.1","10.7.2","10.8.0","10.9.0","8.24.0","8.25.1","8.25.2","8.26.0","8.27.0","8.27.1","8.27.2","8.28.0","8.28.1","8.29.0","8.30.0","8.31.0","8.32.0","8.33.0","8.34.0","8.35.0","8.36.0","8.36.1","8.37.0","8.38.0","8.38.1","8.39.0","8.39.1","8.40.0","8.41.0","8.41.1","8.41.2","8.42.0","8.42.1","8.43.0","8.44.0","8.45.0","8.45.1","8.45.2","8.45.3","8.46.0","8.46.1","8.46.2","8.46.3","8.47.0","8.47.1","8.48.0","8.48.1","8.48.2","8.48.3","8.48.4","8.49.0","8.50.0","8.50.1","8.51.0","8.52.0","8.52.1","8.52.2","8.53.0","8.54.0","8.54.1","8.54.2","8.54.3","8.54.4","8.55.0","8.57.1","8.58.0","8.59.0","8.60.0","8.61.0","8.61.1","8.61.2","8.62.0","8.62.1","8.62.10","8.62.11","8.62.12","8.62.13","8.62.2","8.62.3","8.62.4","8.62.5","8.62.6","8.62.7","8.62.8","8.62.9","8.63.0","8.63.1","8.64.0","8.65.0","8.66.0","8.67.0","8.68.0","8.68.1","8.68.2","8.69.0","8.70.0","8.71.0","8.72.0","8.73.0","8.74.0","8.75.0","8.75.1","8.76.0","9.0.0","9.0.1","9.0.2","9.0.3","9.0.4","9.0.5","9.0.6","9.2.0","9.2.1","9.3.1"]}],"products":[{"vendor":"doobidoo","product":"mcp-memory-service"}],"references":[{"url":"https://github.com/doobidoo/mcp-memory-service/security/advisories/GHSA-73hc-m4hx-79pj","tags":["x_refsource_CONFIRM","Exploit","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://github.com/doobidoo/mcp-memory-service/commit/18f4323ca92763196aa2922f691dfbeb6bd84e48","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29787","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-73hc-m4hx-79pj","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29787.json","tags":["advisory"]},{"url":"https://github.com/doobidoo/mcp-memory-service","tags":["package"]},{"url":"https://pypi.org/project/mcp-memory-service","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-29787","title":"mcp-memory-service: System Information Disclosure via Health Endpoint","description":"mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.21.0, the /api/health/detailed endpoint returns detailed system information including OS version, Python version, CPU count, memory totals, disk usage, and the full database filesystem path. When MCP_ALLOW_ANONYMOUS_ACCESS=true is set (required for the HTTP server to function without OAuth/API key), this endpoint is accessible without authentication. Combined with the default 0.0.0.0 binding, this exposes sensitive reconnaissance data to the entire network. This issue has been patched in version 10.21.0.","status":"published","published":"2026-03-07T15:34:46.277Z","modified":"2026-03-09T18:26:27.568Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:19:56.284359Z"}],"euvd":[{"id":"EUVD-2026-10165","description":"mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.21.0, the /api/health/detailed endpoint returns detailed system information including OS version, Python version, CPU count, memory totals, disk usage, and the full database filesystem path. When MCP_ALLOW_ANONYMOUS_ACCESS=true is set (required for the HTTP server to function without OAuth/API key), this endpoint is accessible without authentication. Combined with the default 0.0.0.0 binding, this exposes sensitive reconnaissance data to the entire network. This issue has been patched in version 10.21.0.","status":"published","published":"2026-03-07T15:34:46Z","modified":"2026-03-09T18:26:27Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:06.581696Z"}],"ghsa":[{"id":"GHSA-73hc-m4hx-79pj","title":"mcp-memory-service Vulnerable to System Information Disclosure via Health Endpoint","description":"### Summary\nThe `/api/health/detailed` endpoint returns detailed system information including OS version, Python version, CPU count, memory totals, disk usage, and the full database filesystem path. When `MCP_ALLOW_ANONYMOUS_ACCESS=true` is set (required for the HTTP server to function without OAuth/API key), this endpoint is accessible without authentication. Combined with the default `0.0.0.0` binding, this exposes sensitive reconnaissance data to the entire network.\n\n### Details\n### Vulnerable Code\n\n**`health.py:90-101` - System information collection**\n\n```python\nsystem_info = {\n    \"platform\": platform.system(),              # e.g., \"Linux\", \"Darwin\"\n    \"platform_version\": platform.version(),     # Full OS kernel version string\n    \"python_version\": platform.python_version(),# e.g., \"3.12.1\"\n    \"cpu_count\": psutil.cpu_count(),            # CPU core count\n    \"memory_total_gb\": round(memory_info.total / (1024**3), 2),\n    \"memory_available_gb\": round(memory_info.available / (1024**3), 2),\n    \"memory_percent\": memory_info.percent,\n    \"disk_total_gb\": round(disk_info.total / (1024**3), 2),\n    \"disk_free_gb\": round(disk_info.free / (1024**3), 2),\n    \"disk_percent\": round((disk_info.used / disk_info.total) * 100, 2)\n}\n```\n\n**`health.py:131-132` - Database path disclosure**\n\n```python\nif hasattr(storage, 'db_path'):\n    storage_info[\"database_path\"] = storage.db_path  # Full filesystem path\n```\n\n### Authentication Bypass Path\n\nThe `/api/health/detailed` endpoint uses `require_read_access` which calls `get_current_user`. When `MCP_ALLOW_ANONYMOUS_ACCESS=true`, the auth middleware grants access:\n\n```python\n# middleware.py:372-379\nif ALLOW_ANONYMOUS_ACCESS:\n    logger.debug(\"Anonymous access explicitly enabled, granting read-only access\")\n    return AuthenticationResult(\n        authenticated=True,\n        client_id=\"anonymous\",\n        scope=\"read\",\n        auth_method=\"none\"\n    )\n```\n\n**Note**: The basic `/health` endpoint (line 68) has **no auth dependency at all** and returns version and uptime information unconditionally.\n\n### Information Exposed\n\n| Field | Example Value | Reconnaissance Value |\n|-------|--------------|---------------------|\n| `platform` | `\"Linux\"` | OS fingerprinting |\n| `platform_version` | `\"#1 SMP PREEMPT_DYNAMIC...\"` | Kernel version → CVE targeting |\n| `python_version` | `\"3.12.1\"` | Python CVE targeting |\n| `cpu_count` | `8` | Resource enumeration |\n| `memory_total_gb` | `32.0` | Infrastructure profiling |\n| `database_path` | `\"/home/user/.mcp-memory/memories.db\"` | Username + file path disclosure |\n| `database_size_mb` | `45.2` | Data volume estimation |\n\n### Attack Scenario\n\n1. Attacker scans the local network for services on port 8000\n2. Finds mcp-memory-service with HTTP enabled and anonymous access\n3. Calls `GET /api/health/detailed`  (no credentials needed)\n4. Receives OS version, Python version, full database path (revealing username), system resources\n5. Uses this information to:\n   - Target known CVEs for the specific OS/Python version\n   - Identify the database file location for potential direct access\n   - Profile the system for further attacks\n \n### PoC\n\n```python\n# Show the system info that would be exposed\nimport platform, psutil\n\nsystem_info = {\n    \"platform\": platform.system(),\n    \"platform_version\": platform.version(),\n    \"python_version\": platform.python_version(),\n    \"cpu_count\": psutil.cpu_count(),\n    \"memory_total_gb\": round(psutil.virtual_memory().total / (1024**3), 2),\n}\nprint(system_info)  # All of this is returned to unauthenticated users\n```\n\n### Impact\n- **OS fingerprinting**: Exact OS and kernel version enables targeted exploit selection\n- **Path disclosure**: Database path reveals username, home directory structure, and file locations\n- **Resource enumeration**: CPU, memory, and disk info reveal infrastructure scale\n- **Reconnaissance enablement**: Combined information significantly reduces attacker effort for follow-up attacks\n\n## Remediation\n\n1. **Remove system details from default health endpoint** - return only `status`, `version`, `uptime`:\n\n```python\n@router.get(\"/health/detailed\")\nasync def detailed_health_check(\n    storage: MemoryStorage = Depends(get_storage),\n    user: AuthenticationResult = Depends(require_write_access)  # Require admin/write access\n):\n    # Only return storage stats, not system info\n    ...\n```\n\n2. **Do not expose `database_path`** - this leaks the filesystem structure:\n\n```python\n# Remove or redact\n# storage_info[\"database_path\"] = storage.db_path  # REMOVE THIS\n```\n\n3. **Add auth to basic `/health`** or limit it to status-only (no version):\n\n```python\n@router.get(\"/health\")\nasync def health_check():\n    return {\"status\": \"healthy\"}  # No version, no uptime\n```\nAlternatively, **Bind to `127.0.0.1` by default** instead of `0.0.0.0`, preventing network-based reconnaissance entirely:\n\n```python\n# In config.py — change default from '0.0.0.0' to '127.0.0.1'\nHTTP_HOST = os.getenv('MCP_HTTP_HOST', '127.0.0.1')\n```\n\nUsers who need network access can explicitly set `MCP_HTTP_HOST=0.0.0.0`, making the exposure a conscious opt-in rather than a default.","status":"published","published":"2026-03-05T21:42:10Z","modified":"2026-03-09T15:50:09Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:39:33.538417Z"}],"nvd":[{"id":"CVE-2026-29787","description":"mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.21.0, the /api/health/detailed endpoint returns detailed system information including OS version, Python version, CPU count, memory totals, disk usage, and the full database filesystem path. When MCP_ALLOW_ANONYMOUS_ACCESS=true is set (required for the HTTP server to function without OAuth/API key), this endpoint is accessible without authentication. Combined with the default 0.0.0.0 binding, this exposes sensitive reconnaissance data to the entire network. This issue has been patched in version 10.21.0.","status":"published","published":"2026-03-07T16:15:55.743Z","modified":"2026-06-17T10:29:53.17Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:08.279852Z"}],"osv":[{"id":"CVE-2026-29787","title":"mcp-memory-service: System Information Disclosure via Health Endpoint","description":"mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.21.0, the /api/health/detailed endpoint returns detailed system information including OS version, Python version, CPU count, memory totals, disk usage, and the full database filesystem path. When MCP_ALLOW_ANONYMOUS_ACCESS=true is set (required for the HTTP server to function without OAuth/API key), this endpoint is accessible without authentication. Combined with the default 0.0.0.0 binding, this exposes sensitive reconnaissance data to the entire network. This issue has been patched in version 10.21.0.","status":"published","published":"2026-03-07T15:34:46.277Z","modified":"2026-10-28T02:31:15.110421876Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:45:00.530889Z"},{"id":"GHSA-73hc-m4hx-79pj","title":"mcp-memory-service Vulnerable to System Information Disclosure via Health Endpoint","description":"### Summary\nThe `/api/health/detailed` endpoint returns detailed system information including OS version, Python version, CPU count, memory totals, disk usage, and the full database filesystem path. When `MCP_ALLOW_ANONYMOUS_ACCESS=true` is set (required for the HTTP server to function without OAuth/API key), this endpoint is accessible without authentication. Combined with the default `0.0.0.0` binding, this exposes sensitive reconnaissance data to the entire network.\n\n### Details\n### Vulnerable Code\n\n**`health.py:90-101` - System information collection**\n\n```python\nsystem_info = {\n    \"platform\": platform.system(),              # e.g., \"Linux\", \"Darwin\"\n    \"platform_version\": platform.version(),     # Full OS kernel version string\n    \"python_version\": platform.python_version(),# e.g., \"3.12.1\"\n    \"cpu_count\": psutil.cpu_count(),            # CPU core count\n    \"memory_total_gb\": round(memory_info.total / (1024**3), 2),\n    \"memory_available_gb\": round(memory_info.available / (1024**3), 2),\n    \"memory_percent\": memory_info.percent,\n    \"disk_total_gb\": round(disk_info.total / (1024**3), 2),\n    \"disk_free_gb\": round(disk_info.free / (1024**3), 2),\n    \"disk_percent\": round((disk_info.used / disk_info.total) * 100, 2)\n}\n```\n\n**`health.py:131-132` - Database path disclosure**\n\n```python\nif hasattr(storage, 'db_path'):\n    storage_info[\"database_path\"] = storage.db_path  # Full filesystem path\n```\n\n### Authentication Bypass Path\n\nThe `/api/health/detailed` endpoint uses `require_read_access` which calls `get_current_user`. When `MCP_ALLOW_ANONYMOUS_ACCESS=true`, the auth middleware grants access:\n\n```python\n# middleware.py:372-379\nif ALLOW_ANONYMOUS_ACCESS:\n    logger.debug(\"Anonymous access explicitly enabled, granting read-only access\")\n    return AuthenticationResult(\n        authenticated=True,\n        client_id=\"anonymous\",\n        scope=\"read\",\n        auth_method=\"none\"\n    )\n```\n\n**Note**: The basic `/health` endpoint (line 68) has **no auth dependency at all** and returns version and uptime information unconditionally.\n\n### Information Exposed\n\n| Field | Example Value | Reconnaissance Value |\n|-------|--------------|---------------------|\n| `platform` | `\"Linux\"` | OS fingerprinting |\n| `platform_version` | `\"#1 SMP PREEMPT_DYNAMIC...\"` | Kernel version → CVE targeting |\n| `python_version` | `\"3.12.1\"` | Python CVE targeting |\n| `cpu_count` | `8` | Resource enumeration |\n| `memory_total_gb` | `32.0` | Infrastructure profiling |\n| `database_path` | `\"/home/user/.mcp-memory/memories.db\"` | Username + file path disclosure |\n| `database_size_mb` | `45.2` | Data volume estimation |\n\n### Attack Scenario\n\n1. Attacker scans the local network for services on port 8000\n2. Finds mcp-memory-service with HTTP enabled and anonymous access\n3. Calls `GET /api/health/detailed`  (no credentials needed)\n4. Receives OS version, Python version, full database path (revealing username), system resources\n5. Uses this information to:\n   - Target known CVEs for the specific OS/Python version\n   - Identify the database file location for potential direct access\n   - Profile the system for further attacks\n \n### PoC\n\n```python\n# Show the system info that would be exposed\nimport platform, psutil\n\nsystem_info = {\n    \"platform\": platform.system(),\n    \"platform_version\": platform.version(),\n    \"python_version\": platform.python_version(),\n    \"cpu_count\": psutil.cpu_count(),\n    \"memory_total_gb\": round(psutil.virtual_memory().total / (1024**3), 2),\n}\nprint(system_info)  # All of this is returned to unauthenticated users\n```\n\n### Impact\n- **OS fingerprinting**: Exact OS and kernel version enables targeted exploit selection\n- **Path disclosure**: Database path reveals username, home directory structure, and file locations\n- **Resource enumeration**: CPU, memory, and disk info reveal infrastructure scale\n- **Reconnaissance enablement**: Combined information significantly reduces attacker effort for follow-up attacks\n\n## Remediation\n\n1. **Remove system details from default health endpoint** - return only `status`, `version`, `uptime`:\n\n```python\n@router.get(\"/health/detailed\")\nasync def detailed_health_check(\n    storage: MemoryStorage = Depends(get_storage),\n    user: AuthenticationResult = Depends(require_write_access)  # Require admin/write access\n):\n    # Only return storage stats, not system info\n    ...\n```\n\n2. **Do not expose `database_path`** - this leaks the filesystem structure:\n\n```python\n# Remove or redact\n# storage_info[\"database_path\"] = storage.db_path  # REMOVE THIS\n```\n\n3. **Add auth to basic `/health`** or limit it to status-only (no version):\n\n```python\n@router.get(\"/health\")\nasync def health_check():\n    return {\"status\": \"healthy\"}  # No version, no uptime\n```\nAlternatively, **Bind to `127.0.0.1` by default** instead of `0.0.0.0`, preventing network-based reconnaissance entirely:\n\n```python\n# In config.py — change default from '0.0.0.0' to '127.0.0.1'\nHTTP_HOST = os.getenv('MCP_HTTP_HOST', '127.0.0.1')\n```\n\nUsers who need network access can explicitly set `MCP_HTTP_HOST=0.0.0.0`, making the exposure a conscious opt-in rather than a default.","status":"published","published":"2026-03-05T21:42:10Z","modified":"2026-07-13T16:42:49.086419999Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:40.308826Z"},{"id":"PYSEC-2026-2623","title":"mcp-memory-service Vulnerable to System Information Disclosure via Health Endpoint","description":"### Summary\nThe `/api/health/detailed` endpoint returns detailed system information including OS version, Python version, CPU count, memory totals, disk usage, and the full database filesystem path. When `MCP_ALLOW_ANONYMOUS_ACCESS=true` is set (required for the HTTP server to function without OAuth/API key), this endpoint is accessible without authentication. Combined with the default `0.0.0.0` binding, this exposes sensitive reconnaissance data to the entire network.\n\n### Details\n### Vulnerable Code\n\n**`health.py:90-101` - System information collection**\n\n```python\nsystem_info = {\n    \"platform\": platform.system(),              # e.g., \"Linux\", \"Darwin\"\n    \"platform_version\": platform.version(),     # Full OS kernel version string\n    \"python_version\": platform.python_version(),# e.g., \"3.12.1\"\n    \"cpu_count\": psutil.cpu_count(),            # CPU core count\n    \"memory_total_gb\": round(memory_info.total / (1024**3), 2),\n    \"memory_available_gb\": round(memory_info.available / (1024**3), 2),\n    \"memory_percent\": memory_info.percent,\n    \"disk_total_gb\": round(disk_info.total / (1024**3), 2),\n    \"disk_free_gb\": round(disk_info.free / (1024**3), 2),\n    \"disk_percent\": round((disk_info.used / disk_info.total) * 100, 2)\n}\n```\n\n**`health.py:131-132` - Database path disclosure**\n\n```python\nif hasattr(storage, 'db_path'):\n    storage_info[\"database_path\"] = storage.db_path  # Full filesystem path\n```\n\n### Authentication Bypass Path\n\nThe `/api/health/detailed` endpoint uses `require_read_access` which calls `get_current_user`. When `MCP_ALLOW_ANONYMOUS_ACCESS=true`, the auth middleware grants access:\n\n```python\n# middleware.py:372-379\nif ALLOW_ANONYMOUS_ACCESS:\n    logger.debug(\"Anonymous access explicitly enabled, granting read-only access\")\n    return AuthenticationResult(\n        authenticated=True,\n        client_id=\"anonymous\",\n        scope=\"read\",\n        auth_method=\"none\"\n    )\n```\n\n**Note**: The basic `/health` endpoint (line 68) has **no auth dependency at all** and returns version and uptime information unconditionally.\n\n### Information Exposed\n\n| Field | Example Value | Reconnaissance Value |\n|-------|--------------|---------------------|\n| `platform` | `\"Linux\"` | OS fingerprinting |\n| `platform_version` | `\"#1 SMP PREEMPT_DYNAMIC...\"` | Kernel version → CVE targeting |\n| `python_version` | `\"3.12.1\"` | Python CVE targeting |\n| `cpu_count` | `8` | Resource enumeration |\n| `memory_total_gb` | `32.0` | Infrastructure profiling |\n| `database_path` | `\"/home/user/.mcp-memory/memories.db\"` | Username + file path disclosure |\n| `database_size_mb` | `45.2` | Data volume estimation |\n\n### Attack Scenario\n\n1. Attacker scans the local network for services on port 8000\n2. Finds mcp-memory-service with HTTP enabled and anonymous access\n3. Calls `GET /api/health/detailed`  (no credentials needed)\n4. Receives OS version, Python version, full database path (revealing username), system resources\n5. Uses this information to:\n   - Target known CVEs for the specific OS/Python version\n   - Identify the database file location for potential direct access\n   - Profile the system for further attacks\n \n### PoC\n\n```python\n# Show the system info that would be exposed\nimport platform, psutil\n\nsystem_info = {\n    \"platform\": platform.system(),\n    \"platform_version\": platform.version(),\n    \"python_version\": platform.python_version(),\n    \"cpu_count\": psutil.cpu_count(),\n    \"memory_total_gb\": round(psutil.virtual_memory().total / (1024**3), 2),\n}\nprint(system_info)  # All of this is returned to unauthenticated users\n```\n\n### Impact\n- **OS fingerprinting**: Exact OS and kernel version enables targeted exploit selection\n- **Path disclosure**: Database path reveals username, home directory structure, and file locations\n- **Resource enumeration**: CPU, memory, and disk info reveal infrastructure scale\n- **Reconnaissance enablement**: Combined information significantly reduces attacker effort for follow-up attacks\n\n## Remediation\n\n1. **Remove system details from default health endpoint** - return only `status`, `version`, `uptime`:\n\n```python\n@router.get(\"/health/detailed\")\nasync def detailed_health_check(\n    storage: MemoryStorage = Depends(get_storage),\n    user: AuthenticationResult = Depends(require_write_access)  # Require admin/write access\n):\n    # Only return storage stats, not system info\n    ...\n```\n\n2. **Do not expose `database_path`** - this leaks the filesystem structure:\n\n```python\n# Remove or redact\n# storage_info[\"database_path\"] = storage.db_path  # REMOVE THIS\n```\n\n3. **Add auth to basic `/health`** or limit it to status-only (no version):\n\n```python\n@router.get(\"/health\")\nasync def health_check():\n    return {\"status\": \"healthy\"}  # No version, no uptime\n```\nAlternatively, **Bind to `127.0.0.1` by default** instead of `0.0.0.0`, preventing network-based reconnaissance entirely:\n\n```python\n# In config.py — change default from '0.0.0.0' to '127.0.0.1'\nHTTP_HOST = os.getenv('MCP_HTTP_HOST', '127.0.0.1')\n```\n\nUsers who need network access can explicitly set `MCP_HTTP_HOST=0.0.0.0`, making the exposure a conscious opt-in rather than a default.","status":"published","published":"2026-07-13T14:36:41.095636Z","modified":"2026-07-13T16:32:13.346736655Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:55.961245Z"}]}}