Evidence · DiggingBeagle record
MCP Memory Service local transport cross-origin advisory
Maintainer advisory covering wildcard CORS, loopback MCP requests, DNS rebinding and patch 12.6.0.
- Source role
- primary disclosure
Evidence record
Maintainer advisory covering wildcard CORS, loopback MCP requests, DNS rebinding and patch 12.6.0.
Claim-level citations (1)
- supportsA webpage could mutate local MCP agent memory through permissive CORS: MCP Memory Service versions through 12.5.0 allowed unauthenticated loopback MCP HTTP transport with a permissive default CORS preflight, enabling pages to send tools/call requests that changed or deleted stored memories.
Advisory Summary; affected and patched versions; cross-origin request path