Read the docs
TI-2026-42578 Aliases CVE-2026-59705GHSA-xgj7-grxr-prrp

mem0 - OpenMemory API Unauthenticated Access via Memory Endpoints

Priority HIGH 81CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by accessing API routers registered without authentication middleware. Attackers can supply arbitrary user_id parameters or directly access memory retrieval endpoints to expose private memory content, or invoke pause endpoints with global_pause=true to cause denial-of-service across all users.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00636 50th percentileScored 2026-11-07
Fix Fixed mem0 (mem0): a3154d5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mem0mem0before a3154d5a3154d5Patch availableCNA
  • mem0 Vendormem0 Affected before a3154d5 Fixed in a3154d5 Patch available CNA

Remediation

  • Fix · CNA mem0 (mem0) Fixed in a3154d5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-59705
  2. 2026-10-03 Alias added: GHSA-xgj7-grxr-prrp

References

Patch 1

Other 2

  • TI-2026-42579 mem0 - Unauthenticated Config API Exposure and SSRF via ollama_base_url CVSS 4.0CRITICAL 9.2
  • TI-2026-23903 The mem0 v1.0.0 server lacks authentication and authorization controls for its memory… CVSS 3.1CRITICAL 9.1
  • TI-2026-23904 The mem0 1.0.0 server lacks authentication and authorization controls for its memory… CVSS 3.1MEDIUM 6.5
  • TI-2026-23906 The mem0 1.0.0 server lacks authentication and authorization controls for its memory… CVSS 3.1MEDIUM 5.3
  • TI-2026-23905 The mem0 1.0.0 server lacks authentication and authorization controls for its memory… CVSS 3.1MEDIUM 6.5
  • TI-2026-23902 The mem0 1.0.0 server lacks authentication and authorization controls for its memory… CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences