CVE-2026-29787

The /api/health/detailed endpoint returns detailed system information including OS version, Python version, CPU count, memory totals, disk usage, and the full database filesystem path. When MCP_ALLOW_ANONYMOUS_ACCESS=true is set (required for the HTTP server to function without OAuth/API key), this endpoint is accessible without authentication. Combined with the default 0.0.0.0 binding, this exposes sensitive reconnaissance data to the entire network.

Details

Vulnerable Code

health.py:90-101 - System information collection

system_info = {
    "platform": platform.system(),              # e.g., "Linux", "Darwin"
    "platform_version": platform.version(),     # Full OS kernel version string
    "python_version": platform.python_version(),# e.g., "3.12.1"
    "cpu_count": psutil.cpu_count(),            # CPU core count
    "memory_total_gb": round(memory_info.total / (1024**3), 2),
    "memory_available_gb": round(memory_info.available / (1024**3), 2),
    "memory_percent": memory_info.percent,
    "disk_total_gb": round(disk_info.total / (1024**3), 2),
    "disk_free_gb": round(disk_info.free / (1024**3), 2),
    "disk_percent": round((disk_info.used / disk_info.total) * 100, 2)
}

health.py:131-132 - Database path disclosure

if hasattr(storage, 'db_path'):
    storage_info["database_path"] = storage.db_path  # Full filesystem path

Authentication Bypass Path

The /api/health/detailed endpoint uses require_read_access which calls get_current_user. When MCP_ALLOW_ANONYMOUS_ACCESS=true, the auth middleware grants access:

# middleware.py:372-379
if ALLOW_ANONYMOUS_ACCESS:
    logger.debug("Anonymous access explicitly enabled, granting read-only access")
    return AuthenticationResult(
        authenticated=True,
        client_id="anonymous",
        scope="read",
        auth_method="none"
    )

Note: The basic /health endpoint (line 68) has no auth dependency at all and returns version and uptime information unconditionally.

Information Exposed

Attack Scenario

1. Attacker scans the local network for services on port 8000
2. Finds mcp-memory-service with HTTP enabled and anonymous access
3. Calls GET /api/health/detailed (no credentials needed)
4. Receives OS version, Python version, full database path (revealing username), system resources
5. Uses this information to:
   • Target known CVEs for the specific OS/Python version
   • Identify the database file location for potential direct access
   • Profile the system for further attacks

PoC

# Show the system info that would be exposed
import platform, psutil

system_info = {
    "platform": platform.system(),
    "platform_version": platform.version(),
    "python_version": platform.python_version(),
    "cpu_count": psutil.cpu_count(),
    "memory_total_gb": round(psutil.virtual_memory().total / (1024**3), 2),
}
print(system_info)  # All of this is returned to unauthenticated users