CVE-2026-116575 with a CVSS score of 6.3 is a cross-tenant information disclosure and data integrity flaw in the mem0ai Python and TypeScript SDKs, specifically in the session-scope key construction used by the memory storage component. The affected versions are mem0ai (pip) versions below 2.0.18 and mem0ai (npm) versions below 3.1.6. The flaw occurs because user-supplied identifiers such as run_id, agent_id, or user_id are joined into a query key with unescaped ampersand and equals delimiters, while validation only rejects empty or whitespace-only values. An attacker who can control their own run_id or agent_id, for example through a public add API or REST endpoint, can embed delimiter characters to forge a scope string that matches another tenant’s scope. This allows the attacker to read the victim’s recent raw conversation messages and inject them into their own fact-extraction prompt, and can also write or evict messages in the colliding storage rows. The business impact is unauthorized access to confidential conversation content, potentially including personal data or credentials, plus persistent cross-tenant corruption of stored memory history, undermining trust in multi-tenant deployments.
The following reports contain further technical details:[/subscribe_to_unlock_form]
CVE-2026-116575 with a CVSS score of 6.3 is a cross-tenant information disclosure and data integrity flaw in the mem0ai Python and TypeScript SDKs, specifically in the session-scope key construction used by the memory storage component. The affected versions are mem0ai (pip) versions below 2.0.18 and mem0ai (npm) versions below 3.1.6. The flaw occurs because user-supplied identifiers such as run_id, agent_id, or user_id are joined into a query key with unescaped ampersand and equals delimiters, while validation only rejects empty or whitespace-only values. An attacker who can control their own run_id or agent_id, for example through a public add API or REST endpoint, can embed delimiter characters to forge a scope string that matches another tenant’s scope. This allows the attacker to read the victim’s recent raw conversation messages and inject them into their own fact-extraction prompt, and can also write or evict messages in the colliding storage rows. The business impact is unauthorized access to confidential conversation content, potentially including personal data or credentials, plus persistent cross-tenant corruption of stored memory history, undermining trust in multi-tenant deployments.
The following reports contain further technical details:[emaillocker id="1283"]
[/emaillocker]