What’s Vulnerable › Vulnerabilities

CVE-2026-59705: mem0 - OpenMemory API Unauthenticated Access via Memory Endpoints

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-07 · updated 2026-10-25
• Weakness: CWE-306

Description

mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by accessing API routers registered without authentication middleware. Attackers can supply arbitrary user_id parameters or directly access memory retrieval endpoints to expose private memory content, or invoke pause endpoints with global_pause=true to cause denial-of-service across all users.

Affected products

• mem0: before a3154d5 — fixed in a3154d5

How to fix

Upgrade to a fixed version: mem0 a3154d5. Check the vendor advisory for mitigations.

References

• https://github.com/mem0ai/mem0
• https://github.com/mem0ai/mem0/commit/a3154d59e52386d4e1189c1f5f44819868f76514
• https://github.com/mem0ai/mem0/issues/6080
• https://www.vulncheck.com/advisories/mem0-openmemory-api-unauthenticated-access-via-memory-endpoints
• https://github.com/mem0ai/mem0/issues/6080

Get alerted when CVE-2026-59705 or the next vulnerability affects your stack