Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

MemOS Authentication Bypass: Unauthenticated Access to Admin Endpoints

CVE-2026-75110 · published 17 days ago
Summary

MemOS, a memory operating system for AI agents, has a security issue that allows an attacker to access sensitive admin endpoints without authentication. This could lead to unauthorized actions such as generating API keys, revoking existing keys, and accessing sensitive data. To fix this, ensure the INTERNAL_SERVICE_SECRET environment variable is set, and consider implementing additional security measures to protect your MemOS deployment.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
memtensor memos <= 2.0.30
Original advisory text
MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled (AUTH_ENABLED=true) but the undocumented, defaultless INTERNAL_SERVICE_SECRET environment v...
MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled (AUTH_ENABLED=true) but the undocumented, defaultless INTERNAL_SERVICE_SECRET environment variable is unset, the is_internal_request() check in src/memos/api/middleware/auth.py fails open: os.getenv("INTERNAL_SERVICE_SECRET") returns None and a request omitting the X-Internal-Service header also yields None, so the comparison None == None evaluates true. The request is then treated as a trusted internal principal and granted scopes: ["all"]. As a result, an unauthenticated remote attacker can reach the admin API-key management endpoints to mint API keys for any user, enumerate keys, revoke keys, and generate a master key for persistent privileged access, as well as all data endpoints.
References
Severity
9.3 Critical
CVSS 3.1: 9.8 (NVD)
CVSS 4.0: 9.3 (NVD)
Exploitation
EPSS <1%
Type
CWE-697Incorrect Comparison
Timeline
Published17 Aug 2026
Updated3 Sep 2026
First seen17 Aug 2026
Sources
CVE-2026-75110 · NVD
CVE-2026-75110 · MITRE
Monitor software like this
Free during beta