PT-2026-56268 · Mem0 · Mem0

George Chen · Published 2026-07-07 · Updated 2026-07-07 · CVE-2026-59706

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions mem0 (affected versions not specified)

Description Unauthenticated config API endpoints expose LLM API keys in plaintext and enable server-side request forgery (SSRF), a technique where an attacker induces the server to make requests to an unintended location. Attackers can retrieve stored secrets, such as OpenAI API keys, via the 'GET /api/v1/config/' endpoint. Additionally, they can trigger SSRF attacks by manipulating the ollama base url parameter to point to internal addresses, such as the cloud Instance Metadata Service (IMDS), through the 'PUT /api/v1/config/mem0/llm' endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-59706

Affected Products

Mem0

References · 6

• https://github.com/mem0ai/mem0/commit/a3154d59e52386d4e1189c1f5f44819868f76514 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-59706 · Security Note
• https://github.com/mem0ai/mem0/issues/6081 · Note
• https://github.com/mem0ai/mem0 · Note
• https://vulncheck.com/advisories/mem0-server-side-request-forgery-and-plaintext-api-key-exposure-via-unauthenticated-config-endpoints · Note
• https://twitter.com/OrizonCyber/status/2074621996806144162 · Twitter Post