CVE-2026-116575 in Mem0
Summary
by MITRE • 10/26/2026
Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_session_scope() in mem0/memory/main.py and Memory.buildSessionScope() in the TypeScript SDK join caller-controlled user_id, agent_id, and run_id values using unescaped & and = delimiters. A caller can embed another scope component in a controlled identifier so that distinct tenant tuples produce the same session_scope key. Memory.add(), AsyncMemory.add(), and the REST POST /memories flow use that key to read and save recent raw messages, allowing cross-tenant conversation disclosure and eviction or interleaving of another tenant's history. This issue is fixed in Python SDK 2.0.18 and TypeScript SDK 3.1.6.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
Mem0 serves as a persistent memory infrastructure designed to support artificial intelligence agents and applications by maintaining context across interactions. A critical security vulnerability was identified within the session scope construction logic of both the Python Software Development Kit prior to version 2.0.18 and the TypeScript SDK prior to version 3.1.6. The flaw resides in the _build_session_scope() function for Python and Memory.buildSessionScope() for TypeScript, which are responsible for generating unique identifiers that define the boundaries of a user's session context. These functions concatenate caller-controlled inputs including user_id, agent_id, and run_id using ampersand and equals sign delimiters without performing any form of escaping or validation on these values. This design choice creates an opportunity for delimiter injection attacks where malicious actors can manipulate the structure of the generated scope key by embedding additional components within a single identifier field.
The technical nature of this flaw aligns with CWE-78, which covers Improper Neutralization of Special Elements used in an OS Command, although here it applies to data serialization and key generation rather than direct command execution. By allowing unescaped delimiters, the system fails to properly isolate distinct tenant tuples, leading to a collision where different logical tenants can produce identical session scope keys. This violates the fundamental security principle of isolation required for multi-tenant architectures. When an attacker controls one part of the identifier string, they can craft input that results in a hash or key value indistinguishable from that of another legitimate user or tenant within the same system environment.
The operational impact of this vulnerability is severe as it directly compromises data confidentiality and integrity through cross-tenant conversation disclosure. The Memory.add(), AsyncMemory.add() methods, along with the REST POST /memories endpoint, rely on these session scope keys to retrieve recent raw messages for context retrieval and to save new interactions. Because distinct tenants can generate the same key due to delimiter injection, an attacker can access memory data belonging to other users or organizations. Furthermore, this lack of isolation allows for the eviction or interleaving of another tenant's conversation history into their own session stream. This not only exposes sensitive information but also disrupts the continuity and accuracy of AI agent interactions by injecting foreign context that may confuse the model or lead to inappropriate responses based on stolen data.
From a threat modeling perspective, this vulnerability facilitates unauthorized access to restricted resources as defined in MITRE ATT&CK technique T1530, Data from Information Repositories. The ability to read and manipulate another tenant's memory state represents a significant breach of multi-tenancy security boundaries. It enables an adversary to perform data exfiltration by reading sensitive conversations and potentially conduct injection attacks by altering the context window available to AI agents, which could lead to further exploitation vectors such as prompt injection if the agent acts on the interleaved malicious instructions.
To mitigate this risk, organizations utilizing Mem0 must upgrade immediately to Python SDK version 2.0.18 or later and TypeScript SDK version 3.1.6 or later. These updated versions address the delimiter injection flaw by implementing proper escaping mechanisms for user_id, agent_id, and run_id values before they are concatenated into session scope keys. This ensures that each component is treated as a distinct segment regardless of special characters it may contain. Additionally, developers should review their integration patterns to ensure no other parts of the application rely on predictable or unvalidated key generation methods that could be susceptible to similar injection attacks in future updates.