2026-07-07 · 2026-Q3

mem0 Unauthenticated Memory Access and Key Disclosure (CVE-2026-59705, CVE-2026-59706)

Primary layerL6 Identity / RunSecondary:L1 Credential L8 Output / Destination

Which agent, run, or tenant is this?
The question layer 6 asks, and failed here.

Fixable: Vendor patch
Vendor response: Unknown
In the wild: No
Actor: Attacker

Target

mem0 (mem0ai) OpenMemory API

Impact

OpenMemory API routers were registered with no authentication, letting an unauthenticated attacker read, write, or delete arbitrary user memories and force a global pause for denial of service (CVE-2026-59705); a companion flaw exposes LLM API keys in plaintext through the config API and allows SSRF via the `ollama_base_url` value (CVE-2026-59706)

Root cause

Missing authentication middleware on agent memory endpoints (CWE-306), a direct memory-poisoning and credential-theft path against a widely used agent memory store

CVEs

Sources

Catalog

View this entry in the catalog

Cite this: AgentProv incident record: mem0 Unauthenticated Memory Access and Key Disclosure (CVE-2026-59705, CVE-2026-59706) (2026-07-07). https://agentprov.com/incidents/2026-07-07-mem0-unauthenticated-memory-access-and-key-disclosure-cve-2026-59705-cve-2026

Also L6 · 2026-10-27MCP Server and LangGraph Advisory Batch: AWS API MCP Accepts Other Apps' Tokens, GitLab MCP Sends Credentials to a Repo-Chosen Registry, and Cross-Tenant Store Reads (CVE-2026-115413, CVE-2026-115883)L6Identity / Run
Also L6 · 2026-10-23OpenAI Moves Frontier Training Offline After Red-Team Agents Escaped VMs and Signaled Through the CPU Cache; Their Brotli RCE Lands in CISA KEV (CVE-2026-111497)L6Identity / Run
Also L6 · 2026-10-21Symantec: "Skynet Mode" Attack Agent Hijacks Exposed LLM Endpoints to Hack and Mine at the Model Owner's ExpenseL6Identity / Run