PT-2026-56280 · Mem0 · Mem0

George Chen · Published 2026-07-07 · Updated 2026-07-08 · CVE-2026-59705

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mem0 openmemory/api (affected versions not specified)

Description The openmemory/api component allows unauthenticated access to API routers that lack authentication middleware. This enables attackers to read, write, and delete arbitrary user memories by providing arbitrary user id parameters or accessing memory retrieval endpoints. Additionally, attackers can trigger a denial-of-service for all users by invoking pause endpoints with the global pause variable set to true.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-59705

Affected Products

Mem0

References · 8

• https://github.com/mem0ai/mem0/commit/a3154d59e52386d4e1189c1f5f44819868f76514 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-59705 · Security Note
• https://github.com/mem0ai/mem0/issues/6080 · Note
• https://github.com/mem0ai/mem0 · Note
• https://twitter.com/CVEnew/status/2074643363421438265 · Twitter Post
• https://vulncheck.com/advisories/mem0-openmemory-api-unauthenticated-access-via-memory-endpoints · Note
• https://twitter.com/infoflowcloud/status/2074644994170704265 · Twitter Post
• https://twitter.com/OrizonCyber/status/2074659750273335656 · Twitter Post