Binding an MCP server to localhost did not make the browser a trusted principal. Its OPTIONS handler accepted arbitrary origins and headers, and the downstream JSON-RPC endpoint did not require an independent token in the affected deployment mode. An unrelated webpage could therefore induce changes to memory that an agent might later read as its own saved…
Inspect the ClaimsCase · DiggingBeagle record
A webpage could mutate local MCP agent memory through permissive CORS
A local memory tool transport accepted cross-origin JSON-RPC requests without authenticating its loopback caller.
Public disclosure: Nov 6, 2026
Scope
MCP Memory Service Streamable HTTP/SSE deployments without a configured API key or OAuth, up to 12.5.0.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
First-party advisory documents cross-origin unauthenticated tools/call requests against loopback memory through 12.5.0; real customer installation compromise is not established. An impact band remains unassigned because the available evidence does not establish a comparable severity score or verified numerical loss for this assessment.
Assessed Nov 8, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-MCP-MEMORY-LOOPBACK-CORS-01 · MCP Memory Service local transport cross-origin advisory
At a glance
Local network placement is not a proof of user intent. Persistent memory writes need both a local network boundary and an authenticated, origin-aware action policy.
Read the implicationsReading memory contents through DNS rebinding has additional browser and network preconditions. The advisory is a demonstrated exposure, not a census of compromised local installations. The patched release is 12.6.0.
Limits and uncertaintyFull account
Binding an MCP server to localhost did not make the browser a trusted principal. Its OPTIONS handler accepted arbitrary origins and headers, and the downstream JSON-RPC endpoint did not require an independent token in the affected deployment mode. An unrelated webpage could therefore induce changes to memory that an agent might later read as its own saved state.
Reading memory contents through DNS rebinding has additional browser and network preconditions. The advisory is a demonstrated exposure, not a census of compromised local installations. The patched release is 12.6.0.
A browser origin can reach 127.0.0.1 even when the user never asked the agent to visit a remote MCP tool. Where the service accepted wildcard CORS and lacked a separate authentication check, a web page could send tools/call methods that altered persistent memory. The advisory treats retrieval through DNS rebinding as an additional path with distinct prerequisites, so write access and read access should not be reported as interchangeable. Version 12.6.0 adds transport protections; a secure deployment still needs explicit origins and authenticated effectful methods.
Mechanism and trust boundary
- 01
Visit an attacker-controlled website while a vulnerable local MCP HTTP server runs.
- 02
Allow the page to submit cross-origin JSON-RPC tool requests to loopback.
- 03
Delete or poison stored agent memories under the server process authority.
Claims & evidence
CLM-MCP-MEMORY-LOOPBACK-CORS-01MCP Memory Service versions through 12.5.0 allowed unauthenticated loopback MCP HTTP transport with a permissive default CORS preflight, enabling pages to send tools/call requests that changed or deleted stored memories.supported
Basis: reported finding
- supportsMCP Memory Service local transport cross-origin advisoryprimary disclosure
Advisory Summary; affected and patched versions; cross-origin request path
Implications
Local network placement is not a proof of user intent. Persistent memory writes need both a local network boundary and an authenticated, origin-aware action policy.
Controls and mitigations
- Upgrade MCP Memory Service to 12.6.0 or later; require authenticated tool calls and explicit allowed origins rather than wildcard CORS on loopback.
- Separately test memory modification by cross-origin POST and memory reads through DNS-rebinding scenarios; these have different browser and network prerequisites.
Unknowns and contradictions
- Reading memory contents through DNS rebinding has additional browser and network preconditions. The advisory is a demonstrated exposure, not a census of compromised local installations. The patched release is 12.6.0.
Sources and citation
Material revision history
- Nov 8, 2026 · Canonical change recorded · new in release · revision 229