Nocturne Memory: empty API_TOKEN disables auth, exposing the agent knowledge graph to the LAN

Impact

When API_TOKEN is unset or empty the bearer-token middleware skips authentication for every HTTP request. Combined with the documented Docker setup - 0.0.0.0 bind and CORS allow_origins [*] - an operator who follows the quickstart publishes the full knowledge-graph read/write API to anything that can reach the port. Anyone on that network can read, alter or delete all memory entries, including the system://boot and core://* URIs that auto-load into downstream agent sessions, which turns the memory store into a durable prompt-injection channel into every agent that later starts against it. On a shared GPU fleet the blast radius is not this one pod: it is whatever those agents are trusted to do with tools and credentials.

Who can reach it

Adjacent network, unauthenticated: any client that can reach the service port, which by default is every host on the same LAN or pod network. Only applies to deployments that left API_TOKEN unset or empty.

What to do

Upgrade to 2.4.1 or later and restart the service; also set a non-empty API_TOKEN, bind to localhost or a private interface, and narrow CORS rather than relying on the fix alone. Any instance that ran open should have its stored memory entries audited - particularly system://boot and core://* - since injected content survives the upgrade.

References

Related entries

• vLLM: user-supplied structured-output regex compiles with no timeout, hanging an inference workerCVE-2026-55574 · vLLM structured_outputs.regex (xgrammar / outlines grammar compilation)High
• Hugging Face Datasets: pickle-backed pandas builder executes code from a dataset file on loadCVE-2026-57845 · Hugging Face Datasets (deprecated pandas packaged builder, Pandas._generate_tables)High
• XAgent: path traversal in the workspace file endpoint reads any host file outside the Docker sandboxCVE-2026-72713 · XAgent (OpenBMB) workspace file endpoint `/workspace/file`High
• Xinference: model launch API executes attacker-supplied Python because trust_remote_code is always onCVE-2026-76841 · Xinference (Xorbits Inference) model loaders - trust_remote_codeHigh
• Coze Studio: any registered user gets code execution from a workflow code node by defaultCVE-2026-77934 · Coze Studio (workflow code node, unsandboxed python3 subprocess)High
• Ollama: model pull follows cross-host redirects, giving SSRF to internal and metadata endpointsCVE-2026-85180 · Ollama (tensor-layer blob download, cross-host redirect handling)High