Description
mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by accessing API routers registered without authentication middleware. Attackers can supply arbitrary user_id parameters or directly access memory retrieval endpoints to expose private memory content, or invoke pause endpoints with global_pause=true to cause denial-of-service across all users.
Published: 2026-07-07
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an unauthenticated access flaw in mem0’s OpenMemory API. Attackers can read, write, and delete any user memory by calling retrieval endpoints. An attacker can exfiltrate private data, and the same flaw also causes denial‑of-service for all users.

Affected Systems

The affected component is mem0’s OpenMemory API. No specific version information is provided, but the flaw exists in the current open‑source implementation as seen in the repository commit linked in the references. Any deployment that uses this API is potentially affected.

Risk and Exploitability

The CVSS critical severity and an EPSS score of less than 1% indicate a low probability of exploitation, yet the vulnerability is not listed in the CISA KEV catalog. The lack of authentication enables attackers to exploit the flaw from any network location that can reach the API, and no credentials are required to do so.

Generated by OpenCVE AI on July 26, 2026 at 18:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest mem0 release that includes the fix referenced in the GitHub commit a3154d59e52386d4e1189c1f5 the OpenMemory API to enforce unauthenticated access.
  • If an immediate upgrade is not possible, restrict network access to the OpenMemory API by employing firewall rules to block unauthenticated traffic to the vulnerable endpoints.
  • Add authentication middleware to all OpenMemory API routes, ensuring each request includes valid credentials before any memory operation is permitted.

Generated by OpenCVE AI on July 26, 2026 at 18:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 08 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 07 Jul 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Mem0
Mem0 mem0
Vendors & Products Mem0
Mem0 mem0

Tue, 07 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
Description mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by accessing API routers registered without authentication middleware. Attackers can supply arbitrary user_id parameters or directly access memory retrieval endpoints to expose private memory content, or invoke pause endpoints with global_pause=true to cause denial-of-service across all users.
Title mem0 - OpenMemory API Unauthenticated Access via Memory Endpoints
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Mem0 Mem0
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-07-20T17:45:59.306Z

Reserved: 2026-07-06T15:31:46.187Z

Link: CVE-2026-59705

cve-icon Vulnrichment

Updated: 2026-07-08T13:09:35.362Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T19:00:02Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function