CVE-2026-116575 · GHSA-5324-3w58-qpp2

Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)

Risk score: 43/100
CVSS: 6.3 v3.1
Exploit chance (30 days): 0.1%
Published: 26 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_session_scope() in mem0/memory/main.py and Memory.buildSessionScope() in the TypeScript SDK join caller-controlled user_id, agent_id, and run_id values using unescaped & and = deli…
Affected: mem0ai (pip) < 2.0.18; mem0ai (npm) < 3.1.6
Fix: Upgrade mem0ai to 2.0.18 or 3.1.6 (whichever matches your release line) or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

mem0ai: Amber, patch this week. mem0ai contains an SQL injection vulnerability in its Databricks vector store, allowing attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names to execute injected SQL on the configured Databricks SQL warehouse.

The flaws

CVE-2026-116575: Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope) (CVSS 6.3 · EPSS 0%)
CVE-2026-115324: Mem0ai Databricks vector store vulnerable to SQL injection (CVSS 8.1 · EPSS 0%)

The fix

Upgrade mem0ai: 1.0.8 or later on your release line

Who is exposed: {'products': ['mem0ai'], 'packages': ['mem0ai'], 'versions': ['>= 0.1.117, < 1.0.8']}

Where it stands

No known exploitation

Connects to

Same weakness: Information disclosure (CWE-200). 290 other warnings in 30 days

Why it is Yellow

CVSS 6.3 medium
On your watchlist: npm, PyPI

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
mem0ai	pip	< 2.0.18	2.0.18
mem0ai	npm	< 3.1.6	3.1.6

References

Original description

Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_session_scope() in mem0/memory/main.py and Memory.buildSessionScope() in the TypeScript SDK join caller-controlled user_id, agent_id, and run_id values using unescaped & and = delimiters. A caller can embed another scope component in a controlled identifier so that distinct tenant tuples produce the same session_scope key. Memory.add(), AsyncMemory.add(), and the REST POST /memories flow use that key to read and save recent raw messages, allowing cross-tenant conversation disclosure and eviction or interleaving of another tenant's history. This issue is fixed in Python SDK 2.0.18 and TypeScript SDK 3.1.6.

Last activity 28 Oct 2026. Patch Forecast updates every hour.