Resource Consumption Vulnerability in MemTensor memmy-agent
CVE-2026-112157

2.3LOW

Key Information:

Vendor

Memtensor

Status
Memmy-agent
Vendor
CVE Published:
19 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-112157?

A vulnerability in MemTensor's memmy-agent, specifically within the Memory Service component, allows unauthenticated remote access to the function requireAdminWrite. This weakness can lead to resource consumption, potentially resulting in a denial-of-service condition. Although the endpoint exposed to unauthenticated requests was initially designed for local use, it still presents risk, depending on specific browser behaviors. Exploiting this vulnerability is challenging due to its complexity, but given that public exploit code has been released, organizations should monitor for signs of exploitation and implement necessary security measures.

Affected Version(s)

memmy-agent 1.0.0

memmy-agent 1.0.1

memmy-agent 1.0.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-112157 - Proof of Concept

References

https://vuldb.com/vuln/422276
vdb-entrytechnical-description
https://vuldb.com/vuln/422276/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-112157
third-party-advisory

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

notwolf (VulDB User)
.