Nocturne Memory
Approved changes feed: RSS · Atom
cpe:2.3:a:dataojitori:nocturne_memory:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Dataojitori (c96bddab-9a27-561e-9149-40bb10da53f8) |
|---|---|
| Product | Nocturne Memory (b8d9d82e-ea0e-5608-acfc-c9f443f19831) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-44830 |
vulnerable | 2026-06-08 08:05:11.319527 |
Empty API_TOKEN disables authentication on network-reachable HTTP/SSE transport
Nocturne Memory is a lightweight, rollbackable, and visual Long-Term Memory Server for MCP Agents. Prior to 2.4.1, when API_TOKEN is unset or empty, the BearerTokenAuthMiddleware bypasses authentication for all HTTP requests. Combined with the default 0.0.0.0 host binding and CORS allow_origins=["*"], operators following the Docker setup without explicitly setting API_TOKEN expose the full Knowledge-Graph read/write API to any LAN-reachable client. An attacker on the same network can read, write, or delete all memory entries — including system://boot and core://* URIs that auto-load into downstream agent sessions, enabling persistent prompt-injection. This vulnerability is fixed in 2.4.1.
Published: 2026-05-27T14:19:55.126Z
Updated: 2026-05-27T15:33:42.680Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.