---
id: "CVE-2026-112157"
kind: "vulnerability"
aliases: ["CVE-2026-112157"]
title: "memmy-agent memory service: unauthenticated admin shutdown endpoint enables denial of service"
severity: "low"
cvss: 3.1
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "mcp", "memmy-agent", "self-hosted"]
not_affected_if: ["auth-required", "default-config"]
published_at: "2026-10-19T16:17:05+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T04:47:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112157", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# memmy-agent memory service: unauthenticated admin shutdown endpoint enables denial of service

The memory service in MemTensor memmy-agent exposes an admin endpoint that accepts unauthenticated requests when no token is configured. A remote attacker can use it to consume resources or shut the service down, with browser-triggered abuse possible depending on browser behavior.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the memory service sets an admin token; if none is configured, `POST /api/v1/admin/shutdown` accepts unauthenticated requests.
- Confirm the installed version against `1.0.9`, `1.1.1` and `1.2.2`, the versions listed as affected.

## Fix

- Upgrade memmy-agent past the affected versions (`1.0.9`, `1.1.1`, `1.2.2`); the sources say later releases added cross-origin fixes.
- Configure an admin token so the shutdown endpoint requires authentication.

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112157

## From the sources

A weakness has been identified in MemTensor memmy-agent up to 1.0.9/1.1.1/1.2.2. The impacted element is the function requireAdminWrite of the file Memory/src/server/http.ts of the component Memory Service. This manipulation causes resource consumption. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is regarded as difficult. The exploit has been made available to the public and could be used for attacks. The exploit is partially overstated. While "POST /api/v1/admin/shutdown" accepts unauthenticated requests when no token is configured, it’s designed for local use and later received cross-origin fixes. Unauthenticated endpoint exposure is confirmed; browser-triggered DoS remains likely but depends on specific browser behavior.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_