CVE-2026-44830

Vulnerability

In Nocturne Memory versions prior to 2.4.1, the BearerTokenAuthMiddleware bypasses authentication for all HTTP requests when the API_TOKEN environment variable is unset or empty [1]. This issue is compounded by the default host binding of 0.0.0.0 and CORS configuration allow_origins=["*"], meaning operators following the Docker setup without explicitly setting API_TOKEN expose the full Knowledge-Graph read/write API to any LAN-reachable client [1]. The stdio mode (local MCP) is not affected.

Exploitation

An attacker needs only network access to the same LAN as the vulnerable Nocturne Memory server. No authentication is required. The attacker can send arbitrary HTTP requests to the exposed endpoints, including the Knowledge-Graph API, to read, write, or delete any memory entry [1]. This includes system://boot and core://* URIs that auto-load into downstream agent sessions.

Impact

Successful exploitation allows a LAN attacker to fully compromise the memory store: reading sensitive memory entries, writing malicious data, or deleting critical records [1]. By manipulating system://boot and core://* URIs, the attacker can inject persistent prompts into downstream agent sessions, leading to arbitrary agent behavior or information disclosure.

Mitigation

Upgrade to Nocturne Memory version 2.4.1, which refuses to start the HTTP/SSE transport without an API_TOKEN (minimum 32 characters), defaults host binding to 127.0.0.1, restricts CORS to localhost by default, and fails fast in docker-compose.yml on a missing API_TOKEN [1]. As a workaround, operators can set a strong API_TOKEN in the environment and change the host binding to 127.0.0.1 manually [1].