Vulnerability Description
mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by accessing API routers registered without authentication middleware. Attackers can supply arbitrary user_id parameters or directly access memory retrieval endpoints to expose private memory content, or invoke pause endpoints with global_pause=true to cause denial-of-service across all users.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/mem0ai/mem0
- https://github.com/mem0ai/mem0/commit/a3154d59e52386d4e1189c1f5f44819868f76514
- https://github.com/mem0ai/mem0/issues/6080
- https://www.vulncheck.com/advisories/mem0-openmemory-api-unauthenticated-access-
- https://github.com/mem0ai/mem0/issues/6080
FAQ
What is CVE-2026-59705?
CVE-2026-59705 is a vulnerability with a CVSS score of 9.8 (CRITICAL). mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by accessing API routers regis...
How severe is CVE-2026-59705?
CVE-2026-59705 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-59705?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.