MemTensor memmy-agent’s Memory Service contains a flaw in the requireAdminWrite function, which allows an attacker to trigger the POST /api/v1/admin/shutdown endpoint without authentication when no token is configured. The endpoint drains system resources, resulting in a denial―of‑service condition. The weakness is classified under CWE‑400, Uncontrolled Resource Consumption, indicating that resource exhaustion is the primary concern.

The vulnerability exists in MemTensor memmy-agent releases up to 1.0.9, 1.1.1, and 1.2.2. Any deployment running one of these builds without an administrator authentication token is affected.

The CVSS base score of 2.3 signals low to moderate severity, yet the public availability of exploit code and the unauthenticated nature of the endpoint raise the practical risk. EPSS data is not available, so the likelihood of real‑world exploitation remains uncertain, though the vulnerability is not listed in CISA KEV. The likely attack vector is remote over HTTP; the endpoint can be triggered by an automated tool or a web browser, with a high complexity classification but a difficult exploit as noted in the advisory.