Dodge1218

Nocturne Memory is a lightweight, rollbackable, and visual Long-Term Memory Server for MCP Agents. Prior to 2.4.1, when API TOKEN is unset or empty, the BearerTokenAuthMiddleware bypasses authentication for all HTTP requests. Combined with the default 0.0.0.0 host binding and CORS allow origins=["*"], operators following the Docker setup without explicitly setting API TOKEN expose the full Knowledge-Graph read/write API to any LAN-reachable client. An attacker on the same network can read, write, or delete all memory entries — including system://boot and core://* URIs that auto-load into downstream agent sessions, enabling persistent prompt-injection. This vulnerability is fixed in 2.4.1.

**Name of the Vulnerable Software and Affected Versions** Gryph versions prior to 0.7.0 **Description** Gryph implements logging levels to control content stored in a local sqlite database. The default log level is set to `standard`, although documentation incorrectly states it is `minimal`. At both `standard` and `full` logging levels, sensitive `file-write` content is retained in the stored `payload` via the `ContentPreview`, `OldString`, or `NewString` variables. This results in the logging of potentially sensitive file content, which bypasses the sensitive file filter and log level contracts. This issue may lead to the exposure of sensitive data if the local sqlite database is stolen or exported to a remote system. **Recommendations** Update to version 0.7.0.