What is the CVSS score of CVE-2026-31242?

CVE-2026-31242 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of mem0 are affected by CVE-2026-31242?

mem0 v1.0.0 contains a critical unauthenticated remote vulnerability enabling attackers to permanently delete entire database tables via a single HTTP request, resulting in complete data loss and…

How to fix or mitigate CVE-2026-31242?

Within 24 hours: Immediately inventory all systems running mem0 v1.0.0 and isolate instances from untrusted networks; implement network-level access controls restricting /memories endpoint access to authenticated internal sources only. Within 7 days: Contact mem0 vendor for patch timeline and interim guidance; evaluate migration to alternative memory database solutions or establish read-only replica instances as fallback. Within 30 days: Deploy patched mem0 version immediately upon vendor release, or complete migration to alternative platform if no patch timeline is provided.

mem0 CVE-2026-31242

EUVD-2026-29565 CRITICAL

Missing Authorization (CWE-862)

2026-05-12 mitre

GHSA-hfhg-w67x-4fpq

Authentication Bypass Denial Of Service

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 13, 2026 - 15:57 vuln.today

CVSS changed

May 13, 2026 - 15:52 NVD

9.1 (None) 9.1 (CRITICAL)

CVE Published

May 12, 2026 - 00:00 nvd

CRITICAL 9.1

CVE Published

May 12, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The mem0 v1.0.0 server lacks authentication and authorization controls for its memory reset functionality accessible via the DELETE /memories endpoint. An unauthenticated attacker can send a DELETE request that triggers a reset operation, leading to the execution of a DROP TABLE SQL statement. This results in the deletion of the entire memory database table, causing catastrophic data loss and a complete denial of service for all users of the service.

AnalysisAI

Unauthenticated remote attackers can completely destroy the mem0 v1.0.0 memory database by sending a DELETE request to the /memories endpoint, which executes DROP TABLE SQL statements without authentication or authorization checks. This causes irreversible data loss and total service denial for all users. EPSS score of 0.03% suggests low observed exploitation probability despite the CVSS 9.1 critical rating, likely due to mem0's limited deployment footprint. No public exploit code or active exploitation (CISA KEV) confirmed at time of analysis, but SSVC indicates the vulnerability is automatable with a single HTTP request.

Technical ContextAI

mem0 is a memory management server providing a REST API for storing and managing memory data, likely used in AI/LLM applications based on the project context. The vulnerability stems from CWE-862 (Missing Authorization), where the DELETE /memories endpoint exposes direct database operations without implementing authentication middleware or authorization checks. The endpoint accepts DELETE HTTP requests that map directly to destructive SQL DDL operations (DROP TABLE), bypassing any access control layer. This architectural flaw allows the API to treat anonymous requests as trusted administrative operations, violating the principle that state-changing operations require authenticated identity verification and authorization policy enforcement. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms this is a network-accessible endpoint with no complexity barriers and no privilege requirements.

RemediationAI

Upgrade mem0 to a version newer than v1.0.0 that implements authentication and authorization controls for the DELETE /memories endpoint-however, no specific patched version number is confirmed in available advisories, requiring verification directly with the mem0ai project at https://github.com/mem0ai/mem0 for release notes or security patches. If immediate patching is unavailable, implement network-level access controls to restrict the /memories endpoint to trusted administrative IP addresses only, accepting the trade-off that this breaks legitimate remote administration and creates operational overhead for IP allowlist maintenance. Alternatively, deploy a reverse proxy or API gateway (such as nginx, Kong, or AWS API Gateway) in front of mem0 to enforce authentication tokens on all DELETE requests, though this requires development effort to implement token validation and may introduce latency. As a temporary emergency measure, disable the DELETE /memories endpoint entirely at the web server or load balancer level if memory reset functionality is not operationally required, with the trade-off that legitimate administrative cleanup operations become unavailable. Monitor https://nvd.nist.gov/vuln/detail/CVE-2026-31242 for updated vendor guidance.