GitHub Advisoryadvisory · PyPI

GHSA-cgx8-qgvr-f7vf mem0 server lacks authentication and authorization controls for its memory creation API endpoint

MEDIUM Published 2026-05-12 Modified 2026-05-27 Official page ↗
Aliases
CVE-2026-31245
Ecosystem
PyPI
Packages
mem0ai
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-306
Reviewed
2026-05-27

Affected packages

• PyPI mem0ai: <= 1.0.0 (no fix yet)

Description

The mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint (POST /memories). The endpoint allows unauthenticated users to submit arbitrary memory records without verifying their identity or permissions. A remote attacker can exploit this by sending unauthenticated POST requests to create malicious or spoofed memory entries in the database, leading to unauthorized data injection and potential data pollution.

Related

Alias · CVE (1)

  • CVE-2026-31245 The mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint (POST /memories). vulnerability

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References