Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-59705: mem0 OpenMemory API Unauthenticated Access Risk
CVE-2026-59705
CVE-2026-59705
Summary
The mem0 OpenMemory API allows unauthenticated access to user memories, which could lead to private data exposure or denial-of-service. This vulnerability affects the openmemory/api component of mem0. To mitigate this risk, ensure that authentication middleware is properly configured for all API routers and endpoints.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| mem0 | mem0 | < a3154d5 |
Original title
mem0 - OpenMemory API Unauthenticated Access via Memory Endpoints
Original description
mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by accessing API routers registered without authentication middleware. Attackers can supply arbitrary user_id parameters or directly access memory retrieval endpoints to expose private memory content, or invoke pause endpoints with global_pause=true to cause denial-of-service across all users.
mitre CVSS3.1
9.8
Vulnerability type
CWE-306
Missing Authentication for Critical Function
Published: 7 Jul 2026 · Updated: 23 Jul 2026 · First seen: 7 Jul 2026