CVE-2026-75110 in MemOS
Summary
by MITRE • 08/17/2026
MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled (AUTH_ENABLED=true) but the undocumented, defaultless INTERNAL_SERVICE_SECRET environment variable is unset, the is_internal_request() check in src/memos/api/middleware/auth.py fails open: os.getenv("INTERNAL_SERVICE_SECRET") returns None and a request omitting the X-Internal-Service header also yields None, so the comparison None == None evaluates true. The request is then treated as a trusted internal principal and granted scopes: ["all"]. As a result, an unauthenticated remote attacker can reach the admin API-key management endpoints to mint API keys for any user, enumerate keys, revoke keys, and generate a master key for persistent privileged access, as well as all data endpoints.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in MemOS represents a critical authentication bypass rooted in improper handling of environment variables within the internal service verification logic. MemOS is designed as a memory operating system for large language models and AI agents, relying on strict separation between external user requests and trusted internal service communications. The core flaw resides in the src/memos/api/middleware/auth.py module, specifically within the is_internal_request function which determines whether an incoming request originates from a verified internal source. When authentication is enabled via the AUTH_ENABLED flag, this middleware acts as the primary gatekeeper for administrative functions. However, the implementation fails to account for scenarios where the INTERNAL_SERVICE_SECRET environment variable is not configured or remains unset during deployment. This configuration oversight leads directly to a logic error that effectively disables security controls intended to protect sensitive internal endpoints.
From a technical perspective, the failure mechanism relies on Python's handling of None values in equality comparisons. The code retrieves the expected secret using os.getenv("INTERNAL_SERVICE_SECRET"), which returns None if the variable is undefined. Simultaneously, for requests that do not include the X-Internal-Service header, the extracted token value is also None. Consequently, the conditional check comparing these two values evaluates to True because None equals None in Python. This logical fallacy causes the system to incorrectly classify unauthenticated external traffic as trusted internal service requests. As a result of this misclassification, the application grants the requestor full administrative privileges by assigning scopes set to all without requiring any valid credentials or tokens.
The operational impact of this vulnerability is severe and comprehensive, allowing an unauthenticated remote attacker to achieve complete control over the MemOS instance. Once inside the system under the guise of a trusted internal principal, the attacker can access admin API-key management endpoints with impunity. This capability enables the creation of new API keys for any existing user account, facilitating lateral movement within the application and impersonation of legitimate users. Furthermore, attackers can enumerate all currently active API keys to map out the security landscape or revoke them to cause denial of service against other users. Most critically, the ability to generate a master key provides persistent privileged access that survives session expirations and password changes, effectively giving the attacker permanent administrative control over the AI agent infrastructure and associated memory data stores.
This vulnerability aligns with CWE-287 Improper Authentication, as the system fails to correctly verify the identity of users or services attempting to gain access. Additionally, it relates to CWE-15 External Control of System Configuration because the security posture is compromised by an unset environment variable that should have been mandatory for secure operation. In terms of offensive tactics, this flaw facilitates Initial Access through authentication bypass and Privilege Escalation via improper authorization checks. The MITRE ATT&CK framework categorizes these actions under techniques such as T1078 Valid Accounts, where the attacker exploits valid but improperly validated credentials or tokens to maintain access.
Mitigation strategies must address both the code logic and deployment configurations immediately. Developers should modify the is_internal_request function to explicitly check for None values before performing equality comparisons. A robust implementation would require that INTERNAL_SERVICE_SECRET be a non-empty string and that incoming requests present a matching, non-null token in the X-Internal-Service header. If either value is missing or null, the request must be rejected immediately rather than falling through to an open state. Deployment procedures should enforce mandatory configuration of all security-related environment variables, treating unset secrets as fatal errors during startup initialization. This ensures that no instance can run with weakened authentication controls due to misconfiguration. Regular security audits and static analysis tools configured to detect unsafe None comparisons in conditional statements will help prevent similar logic flaws in future updates.