Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-31245 EUVD-2026-29568GHSA-cgx8-qgvr-f7vfPYSEC-2026-2633

mem0 server lacks authentication and authorization controls for its memory creation API endpoint

Published May 12, 2026 · Updated May 13, 2026 · Assigned by mitre

Description

The mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint (POST /memories). The endpoint allows unauthenticated users to submit arbitrary memory records without verifying their identity or permissions. A remote attacker can exploit this by sending unauthenticated POST requests to create malicious or spoofed memory entries in the database, leading to unauthorized data injection and potential data pollution.

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI mem0ai <= 1.0.0 — GHSA-cgx8-qgvr-f7vf

References