CVE-2026-33010: Any Website Can Read and Delete Your Agent's Memories

CVE-2026-33010 dropped March 20 with a CVSS 8.1, targeting mcp-memory-service — the open-source memory backend that a large number of multi-agent deployments use for persistent agent recall. The vulnerability is straightforward and devastating: when HTTP mode is enabled with anonymous access (MCP_ALLOW_ANONYMOUS_ACCESS=true — the default "easy setup" path), a CORS wildcard configuration allows any malicious webpage to silently read, modify, or delete all stored agent memories via cross-origin JavaScript.

This means if you're running mcp-memory-service with the default configuration and you visit a malicious webpage, that page can enumerate every memory your agents have stored, inject false memories, or wipe the memory store entirely. A second attack vector enables direct network access without CORS involvement at all.

The combination of insecure-by-default configuration and the sensitive nature of agent memory stores makes this especially dangerous. Agent memories often contain proprietary context, user data, and decision history that would be valuable for social engineering or competitive intelligence. The patch is available in version 10.25.1 — update immediately and audit whether MCP_ALLOW_ANONYMOUS_ACCESS is set in your deployment.

This CVE lands alongside CVE-2026-4496 (CVSS 5.3), an OS command injection in Git-MCP-Server where user-supplied parameters pass directly into child_process.exec without sanitization — the exact vulnerability pattern that accounts for 43% of all MCP-related CVEs filed in 2026. And the OWASP MCP Top 10 now formalizes Shadow MCP Servers as a distinct attack category: unapproved MCP deployments running outside organizational security governance with default credentials and permissive configurations.

The MCP security surface is expanding faster than the ecosystem's security practices. Patch, audit your defaults, and replace exec() with execFile() everywhere.