PT-2026-59276 · Pypi · Mcp-Memory-Service

Published

2026-07-13

·

Updated

2026-07-13

CVSS v3.1

5.3

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

The /api/health/detailed endpoint returns detailed system information including OS version, Python version, CPU count, memory totals, disk usage, and the full database filesystem path. When MCP ALLOW ANONYMOUS ACCESS=true is set (required for the HTTP server to function without OAuth/API key), this endpoint is accessible without authentication. Combined with the default 0.0.0.0 binding, this exposes sensitive reconnaissance data to the entire network.

Details

Vulnerable Code

health.py:90-101 - System information collection
python
system info = {
  "platform": platform.system(),       # e.g., "Linux", "Darwin"
  "platform version": platform.version(),   # Full OS kernel version string
  "python version": platform.python version(),# e.g., "3.12.1"
  "cpu count": psutil.cpu count(),      # CPU core count
  "memory total gb": round(memory info.total / (1024**3), 2),
  "memory available gb": round(memory info.available / (1024**3), 2),
  "memory percent": memory info.percent,
  "disk total gb": round(disk info.total / (1024**3), 2),
  "disk free gb": round(disk info.free / (1024**3), 2),
  "disk percent": round((disk info.used / disk info.total) * 100, 2)
}
health.py:131-132 - Database path disclosure
python
if hasattr(storage, 'db path'):
  storage info["database path"] = storage.db path # Full filesystem path

Authentication Bypass Path

The /api/health/detailed endpoint uses require read access which calls get current user. When MCP ALLOW ANONYMOUS ACCESS=true, the auth middleware grants access:
python
# middleware.py:372-379
if ALLOW ANONYMOUS ACCESS:
  logger.debug("Anonymous access explicitly enabled, granting read-only access")
  return AuthenticationResult(
    authenticated=True,
    client id="anonymous",
    scope="read",
    auth method="none"
  )
Note: The basic /health endpoint (line 68) has no auth dependency at all and returns version and uptime information unconditionally.

Information Exposed

FieldExample ValueReconnaissance Value
platform"Linux"OS fingerprinting
platform version"#1 SMP PREEMPT DYNAMIC..."Kernel version → CVE targeting
python version"3.12.1"Python CVE targeting
cpu count8Resource enumeration
memory total gb32.0Infrastructure profiling
database path"/home/user/.mcp-memory/memories.db"Username + file path disclosure
database size mb45.2Data volume estimation

Attack Scenario

  1. Attacker scans the local network for services on port 8000
  2. Finds mcp-memory-service with HTTP enabled and anonymous access
  3. Calls GET /api/health/detailed (no credentials needed)
  4. Receives OS version, Python version, full database path (revealing username), system resources
  5. Uses this information to:
  • Target known CVEs for the specific OS/Python version
  • Identify the database file location for potential direct access
  • Profile the system for further attacks

PoC

python
# Show the system info that would be exposed
import platform, psutil

system info = {
  "platform": platform.system(),
  "platform version": platform.version(),
  "python version": platform.python version(),
  "cpu count": psutil.cpu count(),
  "memory total gb": round(psutil.virtual memory().total / (1024**3), 2),
}
print(system info) # All of this is returned to unauthenticated users

Impact

  • OS fingerprinting: Exact OS and kernel version enables targeted exploit selection
  • Path disclosure: Database path reveals username, home directory structure, and file locations
  • Resource enumeration: CPU, memory, and disk info reveal infrastructure scale
  • Reconnaissance enablement: Combined information significantly reduces attacker effort for follow-up attacks

Remediation

  1. Remove system details from default health endpoint - return only status, version, uptime:
python
@router.get("/health/detailed")
async def detailed health check(
  storage: MemoryStorage = Depends(get storage),
  user: AuthenticationResult = Depends(require write access) # Require admin/write access
):
  # Only return storage stats, not system info
  ...
  1. Do not expose database path - this leaks the filesystem structure:
python
# Remove or redact
# storage info["database path"] = storage.db path # REMOVE THIS
  1. Add auth to basic /health or limit it to status-only (no version):
python
@router.get("/health")
async def health check():
  return {"status": "healthy"} # No version, no uptime
Alternatively, Bind to 127.0.0.1 by default instead of 0.0.0.0, preventing network-based reconnaissance entirely:
python
# In config.py — change default from '0.0.0.0' to '127.0.0.1'
HTTP HOST = os.getenv('MCP HTTP HOST', '127.0.0.1')
Users who need network access can explicitly set MCP HTTP HOST=0.0.0.0, making the exposure a conscious opt-in rather than a default.

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

PYSEC-2026-2623

Affected Products

Mcp-Memory-Service