CVE-2026-31245

The mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint (POST /memories). The endpoint allows unauthenticated users to submit arbitrary memory records without verifying their identity or permissions. A remote attacker can exploit this by sending unauthenticated POST requests to create malicious or spoofed memory entries in the database, leading to unauthorized data injection and potential data pollution.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/mem0ai/mem0	Product
https://www.notion.so/CVE-2026-31245-35d1e1393188810aab57ff9b49146b05	Mitigation Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mem0:mem0:1.0.0:*:*:*:*:*:*:*

History

19 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) El servidor mem0 1.0.0 carece de controles de autenticación y autorización para su endpoint de API de creación de memoria (POST /memories). El endpoint permite a usuarios no autenticados enviar registros de memoria arbitrarios sin verificar su identidad o permisos. Un atacante remoto puede explotar esto enviando solicitudes POST no autenticadas para crear entradas de memoria maliciosas o falsificadas en la base de datos, lo que lleva a la inyección de datos no autorizada y a una posible contaminación de datos.

Information

Published : 2026-05-12 18:16

Updated : 2026-10-19 22:10

NVD link : CVE-2026-31245

Mitre link : CVE-2026-31245

CVE.ORG link : CVE-2026-31245

JSON object : View

Products Affected

mem0

mem0

CWE

CWE-306

Missing Authentication for Critical Function

CWE-862

Missing Authorization

{"id": "CVE-2026-31245", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31245", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T13:08:15.288912Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-05-12T18:16:53.010", "references": [{"url": "https://github.com/mem0ai/mem0", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://www.notion.so/CVE-2026-31245-35d1e1393188810aab57ff9b49146b05", "tags": ["Mitigation", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint (POST /memories). The endpoint allows unauthenticated users to submit arbitrary memory records without verifying their identity or permissions. A remote attacker can exploit this by sending unauthenticated POST requests to create malicious or spoofed memory entries in the database, leading to unauthorized data injection and potential data pollution."}, {"lang": "es", "value": "El servidor mem0 1.0.0 carece de controles de autenticaci\u00f3n y autorizaci\u00f3n para su endpoint de API de creaci\u00f3n de memoria (POST /memories). El endpoint permite a usuarios no autenticados enviar registros de memoria arbitrarios sin verificar su identidad o permisos. Un atacante remoto puede explotar esto enviando solicitudes POST no autenticadas para crear entradas de memoria maliciosas o falsificadas en la base de datos, lo que lleva a la inyecci\u00f3n de datos no autorizada y a una posible contaminaci\u00f3n de datos."}], "lastModified": "2026-10-19T22:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mem0:mem0:1.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CBD5639B-9888-4EF9-8E41-CC05DBA4720E"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}