Dodge1218

Nocturne Memory is a lightweight, rollbackable, and visual Long-Term Memory Server for MCP Agents. Prior to 2.4.1, when API TOKEN is unset or empty, the BearerTokenAuthMiddleware bypasses authentication for all HTTP requests. Combined with the default 0.0.0.0 host binding and CORS allow origins=["*"], operators following the Docker setup without explicitly setting API TOKEN expose the full Knowledge-Graph read/write API to any LAN-reachable client. An attacker on the same network can read, write, or delete all memory entries — including system://boot and core://* URIs that auto-load into downstream agent sessions, enabling persistent prompt-injection. This vulnerability is fixed in 2.4.1.

**Name of the Vulnerable Software and Affected Versions** Windows-MCP versions prior to 0.7.5 **Description** In SSE and Streamable HTTP transport modes, the MCP control plane is exposed without authentication and utilizes wildcard CORS (Cross-Origin Resource Sharing), which allows any origin, method, or header. This configuration permits arbitrary origins or non-browser clients to access the control plane. Because the server also exposes a `PowerShell` tool that executes caller-controlled commands via the `command` variable as the Windows user running the application, an attacker can achieve arbitrary PowerShell execution. The issue stems from the ` http middleware()` function installing `CORSMiddleware` with wildcard policies and the ` build mcp()` function constructing the instance without an authentication provider. The vulnerability is specifically triggered when using the '/mcp' endpoint to initialize a session and invoke the `tools/call` function for the `PowerShell` tool. **Recommendations** Update to version 0.7.5. As a temporary workaround, avoid using SSE and Streamable HTTP transport modes and use the default stdio mode instead.

**Name of the Vulnerable Software and Affected Versions** Gryph versions prior to 0.7.0 **Description** Gryph implements logging levels to control content stored in a local sqlite database. The default log level is set to `standard`, although documentation incorrectly states it is `minimal`. At both `standard` and `full` logging levels, sensitive `file-write` content is retained in the stored `payload` via the `ContentPreview`, `OldString`, or `NewString` variables. This results in the logging of potentially sensitive file content, which bypasses the sensitive file filter and log level contracts. This issue may lead to the exposure of sensitive data if the local sqlite database is stolen or exported to a remote system. **Recommendations** Update to version 0.7.0.