CVE-2026-44830

Name of the Vulnerable Software and Affected Versions Nocturne Memory versions prior to 2.4.1

Description When the API TOKEN is unset or empty, the BearerTokenAuthMiddleware bypasses authentication for all HTTP requests. This issue, combined with the default 0.0.0.0 host binding and CORS allow origins set to *, allows any client reachable via the local area network to access the full Knowledge-Graph read/write API. An attacker on the same network can read, write, or delete all memory entries, including system://boot and core://* URIs that auto-load into downstream agent sessions, which can lead to persistent prompt-injection.

Recommendations Update to version 2.4.1. Explicitly set the API TOKEN variable to enable authentication.