CVE-2026-31245 json
mem0 server lacks authentication and authorization controls for its memory creation API endpoint
published 2026-05-12 5 mo ago modified 2026-10-19 20 d ago also GHSA-cgx8-qgvr-f7vf , PYSEC-2026-2633 , EUVD-2026-29568
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 27%
- public exploits
- 0
- none known
Summary
The mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint (POST /memories). The endpoint allows unauthenticated users to submit arbitrary memory records without verifying their identity or permissions. A remote attacker can exploit this by sending unauthenticated POST requests to create malicious or spoofed memory entries in the database, leading to unauthorized data injection and potential data pollution.
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| OSV | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | mem0ai | <=1.0.0 |
no fix listed |
Classification
References
-
github.com
/mem0ai/mem0
package, product
-
notion.so
/CVE-2026-31245-35d1e1393188810aab57ff9b49146b05
web, mitigation, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-31245
advisory
-
pypi.org
/project/mem0ai
package
-
github.com
/advisories/GHSA-cgx8-qgvr-f7vf
advisory
Sources
- CVE List CVE-2026-31245
- GitHub Advisory GHSA-cgx8-qgvr-f7vf
- NVD CVE-2026-31245
- OSV PYSEC-2026-2633
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.