Skip to content
OpenAdvisories

Vendor

Dataojitori

1 known vulnerabilities.

Products

nocturne_memory 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.7
    CVE-2026-44830

    Empty API_TOKEN disables authentication on network-reachable HTTP/SSE transport

    Nocturne Memory is a lightweight, rollbackable, and visual Long-Term Memory Server for MCP Agents. Prior to 2.4.1, when API_TOKEN is unset or empty, the BearerTokenAuthMiddleware bypasses authentication for all HTTP requests. Combined with the default 0.0.0.0…

    Dataojitori nocturne_memory