Cortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR`
- Product
- neuro-cortex-memory (Cortex MCP server)
- CVE
- CVE-2026-49986
- Affected
- neuro-cortex-memory <= 3.17.0
- Fixed in
- 3.18.0
Last verified against sources: October 26, 2026
Am I affected?
neuro-cortex-memory (Cortex MCP server): affected neuro-cortex-memory <= 3.17.0. Fixed in 3.18.0.
- Check your version: run
pip show neuro-cortex-memory. Versions <= 3.17.0 of neuro-cortex-memory are affected. [1]
What to do now
- Upgrade to the fixed version: run
pip install --upgrade "neuro-cortex-memory>=3.18.0"(first patched version 3.18.0). [1] - Gate executable dev-source resolution behind an explicit opt-in flag so that only a developer who deliberately sets both
CORTEX_DEV_SOURCE_SYNC=1andCORTEX_DEV_ROOTcan trigger the bootstrap path [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- The Cortex MCP server (
neuro-cortex-memory) treats theCLAUDE_PROJECT_DIRenvironment variable as a trusted Cortex developer checkout. [1] CLAUDE_PROJECT_DIRis set automatically by the Claude Code IDE extension to whichever directory the user has currently open. [1]- The only validation performed by
_is_cortex_root()is a check for the presence of anmcp_server/subdirectory and aui/unified-viz.htmlfile. [1] - An attacker who places these two marker files in a malicious repository can cause Cortex to execute an arbitrary
mcp_server/server/visualize_bootstrap.pyfrom that directory viasubprocess.run([sys.executable, ...]). [1]
Impact
- This is a local arbitrary code execution vulnerability. [1]
- attacker-controlled Python code runs immediately with the full privileges of the victim's local user account [1]
- exfiltration of files, secrets, environment variables, and SSH/GPG keys accessible to the local user [1]
- The secondary path through
http_launcher.pyadditionally allows the attacker to overwrite files in the Cortex plugin cache directory, potentially establishing persistence that survives after the malicious project is closed. [1]
What was done
- Remove
CLAUDE_PROJECT_DIRfrom the dev-source candidate list. [1] - Gate executable dev-source resolution behind an explicit opt-in flag so that only a developer who deliberately sets both
CORTEX_DEV_SOURCE_SYNC=1andCORTEX_DEV_ROOTcan trigger the bootstrap path [1] - Apply the same change to
mcp_server/server/http_launcher.py:80-83to eliminate the secondary rsync execution path. [1] - Packages: pip/neuro-cortex-memory affected <= 3.17.0 patched 3.18.0 [1]
Sources
- GHSA-gvpp-v77h-5w8g — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
[CVE-2026-49986] Cortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR`
Product: neuro-cortex-memory (Cortex MCP server) | Affected: neuro-cortex-memory <= 3.17.0 | Fixed in: 3.18.0
Summary: The Cortex MCP server (`neuro-cortex-memory`) treats the `CLAUDE_PROJECT_DIR` environment variable as a trusted Cortex developer checkout.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/07/cve-2026-49986-neuro-cortex-memory-cortex-mcp-serverCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for CVE-2026-49986
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.