{"id":"CVE-2026-112157","kind":"vulnerability","aliases":["CVE-2026-112157"],"related":[],"title":"memmy-agent memory service: unauthenticated admin shutdown endpoint enables denial of service","description":"A weakness has been identified in MemTensor memmy-agent up to 1.0.9/1.1.1/1.2.2. The impacted element is the function requireAdminWrite of the file Memory/src/server/http.ts of the component Memory Service. This manipulation causes resource consumption. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is regarded as difficult. The exploit has been made available to the public and could be used for attacks. The exploit is partially overstated. While \"POST /api/v1/admin/shutdown\" accepts unauthenticated requests when no token is configured, it’s designed for local use and later received cross-origin fixes. Unauthenticated endpoint exposure is confirmed; browser-triggered DoS remains likely but depends on specific browser behavior.","summary":"The memory service in MemTensor memmy-agent exposes an admin endpoint that accepts unauthenticated requests when no token is configured. A remote attacker can use it to consume resources or shut the service down, with browser-triggered abuse possible depending on browser behavior.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","mcp","memmy-agent","self-hosted"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Check whether the memory service sets an admin token; if none is configured, `POST /api/v1/admin/shutdown` accepts unauthenticated requests.\n- Confirm the installed version against `1.0.9`, `1.1.1` and `1.2.2`, the versions listed as affected.","fix":"- Upgrade memmy-agent past the affected versions (`1.0.9`, `1.1.1`, `1.2.2`); the sources say later releases added cross-origin fixes.\n- Configure an admin token so the shutdown endpoint requires authentication.","status":"open","published_at":"2026-10-19T16:17:05+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:47:48+00:00","updated_at":"2026-10-25T04:47:48+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T04:47:48Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade memmy-agent past the affected versions (`1.0.9`, `1.1.1`, `1.2.2`); the sources say later releases added cross-origin fixes.\n- Configure an admin token so the shutdown endpoint requires authentication.","reach":"internet","title":"memmy-agent memory service: unauthenticated admin shutdown endpoint enables denial of service","impact":"low","summary":"The memory service in MemTensor memmy-agent exposes an admin endpoint that accepts unauthenticated requests when no token is configured. A remote attacker can use it to consume resources or shut the service down, with browser-triggered abuse possible depending on browser behavior.","category":"ai-tooling","nicknames":[],"who_cares":["memmy-agent","self-hosted","mcp"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote attacker shuts down or overloads the memory service","analyst_note":"Confirm the exact affected version range and whether the browser-based cross-origin trigger is reachable in default deployments; check the NVD entry and the upstream memmy-agent repository for the fixed release.","how_to_check":"- Check whether the memory service sets an admin token; if none is configured, `POST /api/v1/admin/shutdown` accepts unauthenticated requests.\n- Confirm the installed version against `1.0.9`, `1.1.1` and `1.2.2`, the versions listed as affected.","needs_analyst":true,"not_affected_if":["auth-required","default-config"],"who_is_affected":"Teams running the MemTensor memmy-agent memory service on a network or reachable from browsers, especially where no admin token is set. The sources describe the endpoint as designed for local use, so a service bound only to localhost is lower exposure. Teams on a fixed version or with an admin token configured can skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000683,"input_tokens":3487,"output_tokens":668,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-112157':16A,19A '-2026':15A,18A '/1.1.1/1.2.2':88C '/api/v1/admin/shutdown':153C '1.0.9':87C 'abus':69B 'accept':43B,154C 'admin':7A,40B 'agent':3A,26B,37B,84C 'ai':21B 'ai-tool':20B 'attack':53B,114C,118C,145C 'avail':136C 'behavior':74B,191C 'browser':67B,73B,181C,190C 'browser-trigg':66B,180C 'caus':107C 'complex':124C 'compon':102C 'configur':50B,161C 'confirm':179C 'consid':120C 'consum':58B 'consumpt':109C 'could':141C 'cross':172C 'cross-origin':171C 'cve':14A,17A 'denial':11A 'depend':71B,187C 'design':164C 'difficult':130C 'dos':183C 'element':91C 'enabl':10A 'endpoint':9A,41B,176C 'exploit':111C,126C,132C,147C 'expos':38B 'exposur':177C 'file':98C 'fix':174C 'function':94C 'high':123C 'host':29B 'identifi':79C 'impact':90C 'later':169C 'like':185C 'local':166C 'made':135C 'manipul':106C 'mcp':23B 'memmi':2A,25B,36B,83C 'memmy-ag':1A,24B,35B,82C 'memori':4A,31B,103C 'memory/src/server/http.ts':99C 'memtensor':34B,81C 'origin':173C 'overst':150C 'partial':149C 'possibl':70B,116C 'post':152C 'public':139C 'receiv':170C 'regard':128C 'remain':184C 'remot':52B,110C 'request':45B,156C 'requireadminwrit':95C 'resourc':59B,108C 'self':28B 'self-host':27B 'servic':5A,13A,32B,63B,104C 'shut':61B 'shutdown':8A 'specif':189C 'token':48B,159C 'tool':22B 'trigger':68B,182C 'unauthent':6A,44B,155C,175C 'use':55B,143C,167C 'weak':76C","nicknames":[],"mitigations":[],"who_affected":"Teams running the MemTensor memmy-agent memory service on a network or reachable from browsers, especially where no admin token is set. The sources describe the endpoint as designed for local use, so a service bound only to localhost is lower exposure. Teams on a fixed version or with an admin token configured can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T16:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112157","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112157","severity":null,"published_at":"2026-10-19T16:17:05+00:00","modified_at":"2026-10-22T04:17:32+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}