Log in Start free

Vulnerability · Published Oct 26, 2026 · Assigned by GitHub_M

CVE-2026-116575Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)

Medium 6.3

In plain English

A medium-severity information exposure in mem0 from mem0ai. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.1%top 98.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_session_scope() in mem0/memory/main.py and Memory.buildSessionScope() in the TypeScript SDK join caller-controlled user_id, agent_id, and run_id values using unescaped & and = delimiters. A caller can embed another scope component in a controlled identifier so that distinct tenant tuples produce the same session_scope key. Memory.add(), AsyncMemory.add(), and the REST POST /memories flow use that key to read and save recent raw messages, allowing cross-tenant conversation disclosure and eviction or interleaving of another tenant's history. This issue is fixed in Python SDK 2.0.18 and TypeScript SDK 3.1.6.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPImem0ai2.0.18GHSA-5324-3w58-qpp2
npmmem0ai3.1.6GHSA-5324-3w58-qpp2

Affected products (as reported)

VendorProductVersions
mem0ai mem0 < 2.0.18

Weakness: CWE-200, CWE-863 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

References