CVE-2026-31245

The mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint (POST /memories). The endpoint allows unauthenticated users to submit arbitrary memory records without verifying their identity or permissions. A remote attacker can exploit this by sending unauthenticated POST requests to create malicious or spoofed memory entries in the database, leading to unauthorized data injection and potential data pollution.

CVSS 3.1

5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 26% of CVEs (scores of 2026-10-25)

CWEs

CWE-306, CWE-862

Published

2026-05-12

Modified

2026-10-19

Record from

the NVD, synced 2026-10-21

Affected

• mem0:mem0

Packages (OSV)

References

• https://github.com/mem0ai/mem0
• https://www.notion.so/CVE-2026-31245-35d1e1393188810aab57ff9b49146b05

Check your stackJSON