TI-2026-80584 Aliases CVE-2026-116575 GHSA-5324-3w58-qpp2

Cross-tenant conversation leak in Mem0 session scope keys

LOW 29CWE-200Published 2026-10-26 · Updated 2026-10-27

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: Information disclosure, Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-863.

Summary

Mem0 Python SDK before 2.0.18 and TypeScript SDK before 3.1.6 are affected. The session scope key built from user_id, agent_id and run_id joins these values with unescaped & and = delimiters, so distinct identifier sets can produce the same key (CWE-863). A local user with low privileges can embed scope components in controlled identifiers to read or interleave another tenant's recent raw messages.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_session_scope() in mem0/memory/main.py and Memory.buildSessionScope() in the TypeScript SDK join caller-controlled user_id, agent_id, and run_id values using unescaped & and = delimiters. A caller can embed another scope component in a controlled identifier so that distinct tenant tuples produce the same session_scope key. Memory.add(), AsyncMemory.add(), and the REST POST /memories flow use that key to read and save recent raw messages, allowing cross-tenant conversation disclosure and eviction or interleaving of another tenant's history. This issue is fixed in Python SDK 2.0.18 and TypeScript SDK 3.1.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00108 1st percentileScored 2026-11-07

Fix Fixed mem0 (mem0ai): 2.0.18mem0ai (PyPI): 2.0.18+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
mem0ai	mem0	before 2.0.18	2.0.18	Patch available	CNA
—	mem0ai (PyPI)	before 2.0.18	2.0.18	Patch available	GHSA-5324-3w58-qpp2
—	mem0ai (npm)	before 3.1.6	3.1.6	Patch available	GHSA-5324-3w58-qpp2

mem0 Vendormem0ai Affected before 2.0.18 Fixed in 2.0.18 Patch available CNA
mem0ai (PyPI) Vendor— Affected before 2.0.18 Fixed in 2.0.18 Patch available GHSA-5324-3w58-qpp2
mem0ai (npm) Vendor— Affected before 3.1.6 Fixed in 3.1.6 Patch available GHSA-5324-3w58-qpp2

Remediation

Fixed versions are Python SDK 2.0.18 (PyPI mem0ai) and TypeScript SDK 3.1.6 (npm mem0ai).

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA mem0 (mem0ai) Fixed in 2.0.18
Fix · GHSA-5324-3w58-qpp2 mem0ai (PyPI) Fixed in 2.0.18 Advisory →
Fix · GHSA-5324-3w58-qpp2 mem0ai (npm) Fixed in 3.1.6 Advisory →

Timeline

2026-10-26 Threatist record created from CVE-2026-116575
2026-10-27 CISA SSVC decision points changed
2026-10-27 Priority changed: MEDIUM → LOW
2026-10-28 Alias added: GHSA-5324-3w58-qpp2
2026-10-28 Fix available: PyPI/[email protected], npm/[email protected] · GHSA-5324-3w58-qpp2
2026-10-28 CVSS score added · GHSA-5324-3w58-qpp2
2026-10-28 Weakness changed · GHSA-5324-3w58-qpp2
2026-10-28 7 new references · GHSA-5324-3w58-qpp2

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-116575

Other 6

TI-2026-36793 Mem0 0.2.8 Missing Authorization via POST /configure Endpoint CVSS 4.0HIGH 8.6
TI-2026-06680 mem0ai mem0 faiss.py pickle.dump deserialization CVSS 4.0MEDIUM 5.3
TI-2026-79261 SQL injection in mem0 Databricks Vector Store CVSS 4.0CRITICAL 9.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences