Unauthenticated API Endpoints in mem0 Expose Sensitive Information and Enable SSRF Attacks

CVE-2026-59706

What is CVE-2026-59706?

The mem0 application features configuration API endpoints that are accessible without authentication, leading to the exposure of sensitive LLM API keys in plaintext. Attackers can exploit this vulnerability by accessing endpoints like GET /api/v1/config/ to retrieve confidential API keys or craft server-side request forgery (SSRF) attacks by manipulating the ollama_base_url parameter. This could allow unauthorized access to internal resources by directing requests to local addresses like cloud IMDS through the PUT /api/v1/config/mem0/llm endpoint.

References