Mem0 vulnerabilities

3 known vulnerabilities in Mem0 from Mem0. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  mem0: Missing Authentication for Critical Functionality

  CVE-2026-59705Jul 7, 2026Mem0

  mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by accessing API routers registered without authentication middleware. Attackers can suppl

• 9.3 Critical severity

  mem0: Missing Authentication for Critical Functionality

  CVE-2026-59706Jul 7, 2026Mem0

  mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request forgery via attacker-controlled ollama_base_url parameter. Unauthenticated attackers can retrieve stored secrets like OpenAI API keys via GET

• 9.1 Critical severity

  Mem0: Missing Authentication for Critical Functionality

  CVE-2026-31242May 12, 2026Mem0

  The mem0 v1.0.0 server lacks authentication and authorization controls for its memory reset functionality accessible via the DELETE /memories endpoint. An unauthenticated attacker can send a DELETE request that triggers a reset operation, leading to the execut