CVE-2026-49986

CVE-2026-49986 is a trust model inversion in the neuro-cortex-memory MCP server. The vulnerability stems from `_find_dev_source()` treating `CLAUDE_PROJECT_DIR` — an environment variable set by Claude Code indicating which directory the developer has open — as a privileged internal path. This variable isn't a trust signal; it's metadata about user intent, recording 'the user has this directory open.' The Cortex developers conflated 'a trusted process set this value' with 'this value is trustworthy,' which is a specific instance of launcher provenance confusion. The attack works by placing two marker files in any repository — `_cortex_dev_source` and `_cortex_root` — then triggering `open_visualization`. The MCP server resolves the developer's current workspace path via `CLAUDE_PROJECT_DIR`, identifies it as a Cortex project via the markers, and executes `visualize_bootstrap.py` from that untrusted directory with the developer's privileges. No validation bypass is required; the trust path is the intended design. The EPSS score of 0.00113 is misleading because it measures known exploits, not blast radius. This is a persistent memory service designed to accumulate state across sessions — project context, prompt histories, possibly API keys. The attacker's goal isn't single-execution code run; it's establishing foothold in a service that holds the developer's cognitive state. The exploit also isn't targeted — it triggers ambiently when a developer clones a malicious repository and a normal workflow invokes visualization. This is a landmine, not a spear-phish. The critical question for assessing residual risk: does the 3.17.1 patch remove dev-source auto-discovery entirely, or does it merely strengthen `_is_cortex_root()` validation? If the feature persists behind stronger marker checks, the architectural vulnerability survives. Convenience features like this have gravitational pull — they get reimplemented when users complain. Examine whether `_find_dev_source()` is gated behind a config flag or scope restriction, not just whether the marker-file checks improved. This vulnerability class — auto-discovering source roots from user-workspace metadata — likely exists in other MCP servers. The pattern of trusting environment variables set by AI coding assistants is structural, not incidental. The fix in Cortex may close this instance, but without ecosystem-wide awareness, identical trust inversions likely persist in other tools.

Reviewed through automated stages and approved by a human before publication.