MCP Memory Keeper: Arbitrary local file read in mcp-memory-keeper context_import via unvalidated filePath

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-54561 · Microsoft / collected KEV context

EUVD-2026-78828

GHSA-f7wf-v2vw-mpcx

cve-program · CVE-2026-54561

• https://github.com/mkreyman/mcp-memory-keeper/security/advisories/GHSA-f7wf-v2vw-mpcx
• https://github.com/mkreyman/mcp-memory-keeper/issues/35
• https://github.com/mkreyman/mcp-memory-keeper/pull/36
• https://github.com/mkreyman/mcp-memory-keeper/commit/58640c22e037572e0b03bc0aa25d015ea98dcc6d
• https://github.com/mkreyman/mcp-memory-keeper/commit/b9369568468007c85f8aec3ae09ca6f611285bc5
• https://github.com/mkreyman/mcp-memory-keeper/commit/e0ab521a9e8343bcab1ca60ccc3601e4d86eaa97
• https://github.com/mkreyman/mcp-memory-keeper/releases/tag/v0.13.0

euvd · EUVD-2026-78828

• https://github.com/mkreyman/mcp-memory-keeper/security/advisories/GHSA-f7wf-v2vw-mpcx
• https://github.com/mkreyman/mcp-memory-keeper/issues/35
• https://github.com/mkreyman/mcp-memory-keeper/pull/36
• https://github.com/mkreyman/mcp-memory-keeper/commit/58640c22e037572e0b03bc0aa25d015ea98dcc6d
• https://github.com/mkreyman/mcp-memory-keeper/commit/b9369568468007c85f8aec3ae09ca6f611285bc5
• https://github.com/mkreyman/mcp-memory-keeper/commit/e0ab521a9e8343bcab1ca60ccc3601e4d86eaa97
• https://github.com/mkreyman/mcp-memory-keeper/releases/tag/v0.13.0

nvd · CVE-2026-54561

• https://github.com/mkreyman/mcp-memory-keeper/commit/58640c22e037572e0b03bc0aa25d015ea98dcc6d
• https://github.com/mkreyman/mcp-memory-keeper/commit/b9369568468007c85f8aec3ae09ca6f611285bc5
• https://github.com/mkreyman/mcp-memory-keeper/commit/e0ab521a9e8343bcab1ca60ccc3601e4d86eaa97
• https://github.com/mkreyman/mcp-memory-keeper/issues/35
• https://github.com/mkreyman/mcp-memory-keeper/pull/36
• https://github.com/mkreyman/mcp-memory-keeper/releases/tag/v0.13.0
• https://github.com/mkreyman/mcp-memory-keeper/security/advisories/GHSA-f7wf-v2vw-mpcx

osv · GHSA-f7wf-v2vw-mpcx

• https://github.com/mkreyman/mcp-memory-keeper/security/advisories/GHSA-f7wf-v2vw-mpcx
• https://github.com/mkreyman/mcp-memory-keeper/issues/35
• https://github.com/mkreyman/mcp-memory-keeper/pull/36
• https://github.com/mkreyman/mcp-memory-keeper/commit/84f6dfa692736a34ff36e2d2cf2188b71facf73b
• https://github.com/mkreyman/mcp-memory-keeper
• https://github.com/mkreyman/mcp-memory-keeper/releases/tag/v0.13.0

No related operational record is retained in the current change model.