Authentication Bypass in MemOS from MemTensor

CVE-2026-75110

What is CVE-2026-75110?

MemOS, a specialized memory operating system meant for large language models and AI agents, is susceptible to an authentication bypass when the INTERNAL_SERVICE_SECRET environment variable is not set. In environments with authentication enabled, the system fails to validate internal requests properly due to the absence of a default value for this variable. As a result, an unauthenticated attacker can exploit this weakness and gain access to sensitive administrative API functionalities. This includes the capability to mint new API keys, enumerate existing keys, revoke those keys, and create a master key, allowing for persistent elevated access to system data.

References