CVE-2026-9468 — MEDIUM (CVSS 6.3)

CISO Take

A path traversal vulnerability in the cline-mcp-memory-bank MCP server allows any network-authenticated attacker to escape the intended project directory during memory bank initialization, potentially reading arbitrary files — including LLM API keys, credentials, and agent configurations — or writing to unauthorized filesystem locations. With a CVSS of 6.3, low attack complexity, no user interaction required, and a public exploit already released, opportunistic exploitation is plausible for any team running this MCP server with non-localhost network exposure. The maintainer has not responded to the disclosure, leaving no official patch; the only current mitigations are restricting the MCP server to localhost, rolling back to a pre-vulnerability commit, or disabling the memory bank entirely until a fix is published.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Medium risk with elevated AI-specific concern. The CVSS 6.3 (AV:N/AC:L/PR:L/UI:N) reflects low friction for exploitation once an attacker has any authenticated foothold. In AI agent contexts the risk is compounded: path traversal against a memory bank server can silently poison agent memory stores — a persistence vector that survives LLM session resets without triggering conventional security controls. The rolling-release model with no versioned artifacts makes patching non-trivial; organizations cannot upgrade to a 'safe version' and must directly monitor the upstream repository. Public exploit availability without a vendor patch raises the effective operational risk above what the base score suggests.

Attack Kill Chain

Initial Access

Attacker with low-privilege network access sends a crafted MCP initialize request to the exposed cline-mcp-memory-bank server, embedding a path traversal payload in the projectPath argument.

AML.T0049

Exploitation

The handleInitializeMemoryBank function in src/index.ts processes the unsanitized projectPath value without validation, resolving the traversal sequence and operating outside the intended project directory boundary.

AML.T0037

Data Access / Memory Poisoning

Attacker reads sensitive files such as API keys and credentials from traversed parent directories, or writes crafted memory bank content to arbitrary filesystem locations accessible to future agent sessions.

AML.T0080.000

Persistence

Poisoned memory bank content persists across AI agent restarts and sessions, silently injecting adversary-controlled context into the LLM's working memory for all subsequent users of the shared MCP server.

AML.T0099

Initial Access

Attacker with low-privilege network access sends a crafted MCP initialize request to the exposed cline-mcp-memory-bank server, embedding a path traversal payload in the projectPath argument.

AML.T0049

Exploitation

The handleInitializeMemoryBank function in src/index.ts processes the unsanitized projectPath value without validation, resolving the traversal sequence and operating outside the intended project directory boundary.

AML.T0037

Data Access / Memory Poisoning

Attacker reads sensitive files such as API keys and credentials from traversed parent directories, or writes crafted memory bank content to arbitrary filesystem locations accessible to future agent sessions.

AML.T0080.000

Persistence

Poisoned memory bank content persists across AI agent restarts and sessions, silently injecting adversary-controlled context into the LLM's working memory for all subsequent users of the shared MCP server.

AML.T0099

Severity & Risk

CVSS 3.1

6.3 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

Attack Surface

AV Network

AC Low

PR Low

UI None

S Unchanged

C Low

I Low

A Low

What should I do?

6 steps

Inventory: Identify all deployments of cline-mcp-memory-bank across development environments and CI/CD pipelines.
Network isolation: Restrict the MCP server's binding to localhost (127.0.0.1) immediately — do not expose on 0.0.0.0 or across network interfaces.
Rollback: If running at or after commit 55c81b9cf6c16700983c84dc4cdea3cafa19a75f, disable the memory bank MCP server until a remediation commit is confirmed upstream.
Least privilege: Run the MCP server process under a dedicated account scoped to the intended project directory, denying access to sensitive home directories and credential stores.
Detection: Enable file-system audit logging (auditd or equivalent) for the MCP server process; alert on path components containing '../' sequences or absolute paths outside the designated project root.
Upstream monitoring: Watch https://github.com/dazeb/cline-mcp-memory-bank for a patch — the maintainer has not yet responded as of the disclosure date.

Classification

Data Extraction Code Execution Agent Plugin AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application AML.T0080.000 - Memory AML.T0083 - Credentials from AI Agent Configuration AML.T0099 - AI Agent Tool Data Poisoning

Compliance Impact

This CVE is relevant to:

EU AI Act

Art. 9 - Risk Management System

ISO 42001

A.10.2 - AI System Data Security

NIST AI RMF

GOVERN 1.1 - AI Risk Governance MANAGE 2.2 - AI Risk Treatment

OWASP LLM Top 10

LLM06 - Sensitive Information Disclosure LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-9468?

A path traversal vulnerability in the cline-mcp-memory-bank MCP server allows any network-authenticated attacker to escape the intended project directory during memory bank initialization, potentially reading arbitrary files — including LLM API keys, credentials, and agent configurations — or writing to unauthorized filesystem locations. With a CVSS of 6.3, low attack complexity, no user interaction required, and a public exploit already released, opportunistic exploitation is plausible for any team running this MCP server with non-localhost network exposure. The maintainer has not responded to the disclosure, leaving no official patch; the only current mitigations are restricting the MCP server to localhost, rolling back to a pre-vulnerability commit, or disabling the memory bank entirely until a fix is published.

Is CVE-2026-9468 actively exploited?

No confirmed active exploitation of CVE-2026-9468 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-9468?

1. Inventory: Identify all deployments of cline-mcp-memory-bank across development environments and CI/CD pipelines. 2. Network isolation: Restrict the MCP server's binding to localhost (127.0.0.1) immediately — do not expose on 0.0.0.0 or across network interfaces. 3. Rollback: If running at or after commit 55c81b9cf6c16700983c84dc4cdea3cafa19a75f, disable the memory bank MCP server until a remediation commit is confirmed upstream. 4. Least privilege: Run the MCP server process under a dedicated account scoped to the intended project directory, denying access to sensitive home directories and credential stores. 5. Detection: Enable file-system audit logging (auditd or equivalent) for the MCP server process; alert on path components containing '../' sequences or absolute paths outside the designated project root. 6. Upstream monitoring: Watch https://github.com/dazeb/cline-mcp-memory-bank for a patch — the maintainer has not yet responded as of the disclosure date.

What systems are affected by CVE-2026-9468?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, MCP server deployments, AI development environments, Agentic pipelines with persistent memory.

What is the CVSS score for CVE-2026-9468?

CVE-2026-9468 has a CVSS v3.1 base score of 6.3 (MEDIUM).

AI Security Impact

Affected AI Architectures

AI agent frameworksMCP server deploymentsAI development environmentsAgentic pipelines with persistent memory

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0049 Exploit Public-Facing Application

AML.T0080.000 Memory

AML.T0083 Credentials from AI Agent Configuration

AML.T0099 AI Agent Tool Data Poisoning

Compliance Controls Affected

EU AI Act: Art. 9

ISO 42001: A.10.2

NIST AI RMF: GOVERN 1.1, MANAGE 2.2

OWASP LLM Top 10: LLM06, LLM07

Technical Details

Original Advisory

A security flaw has been discovered in dazeb cline-mcp-memory-bank up to 55c81b9cf6c16700983c84dc4cdea3cafa19a75f. The affected element is the function handleInitializeMemoryBank of the file src/index.ts. The manipulation of the argument projectPath results in path traversal. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

Exploitation Scenario

An attacker with low-privilege access to an organization's development network sends a crafted MCP initialize request to an exposed cline-mcp-memory-bank server. The projectPath parameter is set to a traversal payload such as '../../../../home/developer/.config/ai-tools/' or '../../../etc/'. The handleInitializeMemoryBank function in src/index.ts passes this value without sanitization, initializing the memory bank at the attacker-controlled directory. In the read path, the attacker retrieves sensitive files including LLM API keys or infrastructure credentials stored in traversed directories. In the write path, the attacker places a crafted memory file at the traversed location — this file is subsequently loaded as context by the AI agent, poisoning its memory across all future sessions for every developer connected to the shared MCP server, silently steering model behavior without triggering any alerts.