CVE-2026-9468: path traversal in memory init

CISO Take

A path traversal vulnerability in the cline-mcp-memory-bank MCP server allows any network-authenticated attacker to escape the intended project directory during memory bank initialization, potentially reading arbitrary files — including LLM API keys, credentials, and agent configurations — or writing to unauthorized filesystem locations. With a CVSS of 6.3, low attack complexity, no user interaction required, and a public exploit already released, opportunistic exploitation is plausible for any team running this MCP server with non-localhost network exposure. The maintainer has not responded to the disclosure, leaving no official patch; the only current mitigations are restricting the MCP server to localhost, rolling back to a pre-vulnerability commit, or disabling the memory bank entirely until a fix is published.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Medium risk with elevated AI-specific concern. The CVSS 6.3 (AV:N/AC:L/PR:L/UI:N) reflects low friction for exploitation once an attacker has any authenticated foothold. In AI agent contexts the risk is compounded: path traversal against a memory bank server can silently poison agent memory stores — a persistence vector that survives LLM session resets without triggering conventional security controls. The rolling-release model with no versioned artifacts makes patching non-trivial; organizations cannot upgrade to a 'safe version' and must directly monitor the upstream repository. Public exploit availability without a vendor patch raises the effective operational risk above what the base score suggests.

How does the attack unfold?

Initial Access

Attacker with low-privilege network access sends a crafted MCP initialize request to the exposed cline-mcp-memory-bank server, embedding a path traversal payload in the projectPath argument.

AML.T0049

Exploitation

The handleInitializeMemoryBank function in src/index.ts processes the unsanitized projectPath value without validation, resolving the traversal sequence and operating outside the intended project directory boundary.

AML.T0037

Data Access / Memory Poisoning

Attacker reads sensitive files such as API keys and credentials from traversed parent directories, or writes crafted memory bank content to arbitrary filesystem locations accessible to future agent sessions.

AML.T0080.000

Persistence

Poisoned memory bank content persists across AI agent restarts and sessions, silently injecting adversary-controlled context into the LLM's working memory for all subsequent users of the shared MCP server.

AML.T0099

Initial Access

Attacker with low-privilege network access sends a crafted MCP initialize request to the exposed cline-mcp-memory-bank server, embedding a path traversal payload in the projectPath argument.

AML.T0049

Exploitation

The handleInitializeMemoryBank function in src/index.ts processes the unsanitized projectPath value without validation, resolving the traversal sequence and operating outside the intended project directory boundary.

AML.T0037

Data Access / Memory Poisoning

Attacker reads sensitive files such as API keys and credentials from traversed parent directories, or writes crafted memory bank content to arbitrary filesystem locations accessible to future agent sessions.

AML.T0080.000

Persistence

Poisoned memory bank content persists across AI agent restarts and sessions, silently injecting adversary-controlled context into the LLM's working memory for all subsequent users of the shared MCP server.

AML.T0099

How severe is it?

CVSS 3.1

6.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C Low

I Low

A Low

What should I do?

6 steps

Inventory: Identify all deployments of cline-mcp-memory-bank across development environments and CI/CD pipelines.
Network isolation: Restrict the MCP server's binding to localhost (127.0.0.1) immediately — do not expose on 0.0.0.0 or across network interfaces.
Rollback: If running at or after commit 55c81b9cf6c16700983c84dc4cdea3cafa19a75f, disable the memory bank MCP server until a remediation commit is confirmed upstream.
Least privilege: Run the MCP server process under a dedicated account scoped to the intended project directory, denying access to sensitive home directories and credential stores.
Detection: Enable file-system audit logging (auditd or equivalent) for the MCP server process; alert on path components containing '../' sequences or absolute paths outside the designated project root.
Upstream monitoring: Watch https://github.com/dazeb/cline-mcp-memory-bank for a patch — the maintainer has not yet responded as of the disclosure date.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Extraction Code Execution Agent Plugin AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application AML.T0080.000 - Memory AML.T0083 - Credentials from AI Agent Configuration AML.T0099 - AI Agent Tool Data Poisoning

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 9 - Risk Management System

ISO 42001

A.10.2 - AI System Data Security

NIST AI RMF

GOVERN 1.1 - AI Risk Governance MANAGE 2.2 - AI Risk Treatment

OWASP LLM Top 10

LLM06 - Sensitive Information Disclosure LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-9468?

A path traversal vulnerability in the cline-mcp-memory-bank MCP server allows any network-authenticated attacker to escape the intended project directory during memory bank initialization, potentially reading arbitrary files — including LLM API keys, credentials, and agent configurations — or writing to unauthorized filesystem locations. With a CVSS of 6.3, low attack complexity, no user interaction required, and a public exploit already released, opportunistic exploitation is plausible for any team running this MCP server with non-localhost network exposure. The maintainer has not responded to the disclosure, leaving no official patch; the only current mitigations are restricting the MCP server to localhost, rolling back to a pre-vulnerability commit, or disabling the memory bank entirely until a fix is published.

Is CVE-2026-9468 actively exploited?

No confirmed active exploitation of CVE-2026-9468 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-9468?

1. Inventory: Identify all deployments of cline-mcp-memory-bank across development environments and CI/CD pipelines. 2. Network isolation: Restrict the MCP server's binding to localhost (127.0.0.1) immediately — do not expose on 0.0.0.0 or across network interfaces. 3. Rollback: If running at or after commit 55c81b9cf6c16700983c84dc4cdea3cafa19a75f, disable the memory bank MCP server until a remediation commit is confirmed upstream. 4. Least privilege: Run the MCP server process under a dedicated account scoped to the intended project directory, denying access to sensitive home directories and credential stores. 5. Detection: Enable file-system audit logging (auditd or equivalent) for the MCP server process; alert on path components containing '../' sequences or absolute paths outside the designated project root. 6. Upstream monitoring: Watch https://github.com/dazeb/cline-mcp-memory-bank for a patch — the maintainer has not yet responded as of the disclosure date.

What systems are affected by CVE-2026-9468?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, MCP server deployments, AI development environments, Agentic pipelines with persistent memory.

What is the CVSS score for CVE-2026-9468?

CVE-2026-9468 has a CVSS v3.1 base score of 6.3 (MEDIUM). The EPSS exploitation probability is 0.34%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksMCP server deploymentsAI development environmentsAgentic pipelines with persistent memory

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0049 Exploit Public-Facing Application

AML.T0080.000 Memory

AML.T0083 Credentials from AI Agent Configuration

AML.T0099 AI Agent Tool Data Poisoning

Compliance Controls Affected

EU AI Act: Art. 9

ISO 42001: A.10.2

NIST AI RMF: GOVERN 1.1, MANAGE 2.2

OWASP LLM Top 10: LLM06, LLM07

What are the technical details?

Original Advisory

A security flaw has been discovered in dazeb cline-mcp-memory-bank up to 55c81b9cf6c16700983c84dc4cdea3cafa19a75f. The affected element is the function handleInitializeMemoryBank of the file src/index.ts. The manipulation of the argument projectPath results in path traversal. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

Exploitation Scenario

An attacker with low-privilege access to an organization's development network sends a crafted MCP initialize request to an exposed cline-mcp-memory-bank server. The projectPath parameter is set to a traversal payload such as '../../../../home/developer/.config/ai-tools/' or '../../../etc/'. The handleInitializeMemoryBank function in src/index.ts passes this value without sanitization, initializing the memory bank at the attacker-controlled directory. In the read path, the attacker retrieves sensitive files including LLM API keys or infrastructure credentials stored in traversed directories. In the write path, the attacker places a crafted memory file at the traversed location — this file is subsequently loaded as context by the AI agent, poisoning its memory across all future sessions for every developer connected to the shared MCP server, silently steering model behavior without triggering any alerts.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.