Mem0 vulnerabilities
We track 3 vulnerabilities in Mem0 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on July 7, 2026.
Latest Mem0 vulnerabilities
- 9.8 Critical severity
mem0: Missing Authentication for Critical Functionality
mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by accessing API routers registered without authentication middleware. Attackers can suppl
- 9.3 Critical severity
mem0: Missing Authentication for Critical Functionality
mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request forgery via attacker-controlled ollama_base_url parameter. Unauthenticated attackers can retrieve stored secrets like OpenAI API keys via GET
- 9.1 Critical severity
Mem0: Missing Authentication for Critical Functionality
The mem0 v1.0.0 server lacks authentication and authorization controls for its memory reset functionality accessible via the DELETE /memories endpoint. An unauthenticated attacker can send a DELETE request that triggers a reset operation, leading to the execut