Unauthenticated API Exposure in Mem0 Server by Mem0 AI
CVE-2026-31245

5.3MEDIUM

Key Information:

Vendor

Mem0 AI

Status
Mem0 Server
Vendor
CVE Published:
12 May 2026

What is CVE-2026-31245?

The Mem0 server version 1.0.0 is susceptible to a significant security flaw that exposes its memory creation API endpoint (POST /memories) to unauthorized access. This vulnerability allows attackers to submit arbitrary memory records without proper authentication or authorization checks. As a result, malicious users can exploit this weakness to inject fake memory entries into the database, compromising the integrity of the data stored and leading to potential data pollution. This lack of control over user permissions poses serious risks to the security and reliability of applications relying on this API.

References

https://github.com/mem0ai/mem0
https://www.notion.so/CVE-2026-31245-35d1e1393188810aab57...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.