Missing Authorization in Mem0 Server Component
CVE-2026-49948
Key Information:
Badges
What is CVE-2026-49948?
The Mem0 server component versions up to 0.2.8 are vulnerable to a missing authorization flaw that allows authenticated users to manipulate global LLM provider and embedder configurations via the POST /configure endpoint. This flaw arises because the existing authentication checks only verify the presence of a JWT or X-API-Key but do not validate the caller's role. Consequently, any authenticated user with a distributed API key can redirect LLM and embedder traffic to a server controlled by an attacker, with such malicious configurations stored in PostgreSQL, potentially affecting all users and API keys within the instance even after server restarts.
Affected Version(s)
mem0 0 <= 0.2.8
mem0 0 <= 0.2.8
mem0 ae7f4062652df1376990221101d1adbb0819c973
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V4
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved