Which versions of Mem0 are affected by CVE-2026-49948?

Mem0 self-hosted server versions through 0.2.8 contain an authorization bypass allowing authenticated API key holders to globally redirect all LLM model traffic to an attacker-controlled server,…. A patch is available.

Is there a public PoC exploit available for CVE-2026-49948?

Yes, a public proof-of-concept exploit is available for CVE-2026-49948. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-49948?

Within 24 hours: Verify current Mem0 version and if ≤0.2.8, restrict API key usage or isolate from production. Within 7 days: Upgrade Mem0 to the patched version (commit ae7f406) and rotate all API keys. Within 30 days: Audit PostgreSQL configuration history and review LLM endpoint logs for unauthorized changes; implement network controls to prevent arbitrary LLM endpoint access.

Mem0 CVE-2026-49948

Q: What is the CVSS score of CVE-2026-49948?

CVE-2026-49948 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-35449 HIGH

Missing Authorization (CWE-862)

2026-06-09 VulnCheck

GHSA-hp66-92p5-jh23

Authentication Bypass PostgreSQL Mem0

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 09, 2026 - 16:29 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 09, 2026 - 16:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 09, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Jun 09, 2026 - 16:22 NVD

8.1 (HIGH) 8.6 (HIGH)

Source Code Evidence Fetched

Jun 09, 2026 - 15:48 vuln.today

Analysis Generated

Jun 09, 2026 - 15:48 vuln.today

CVE Published

Jun 09, 2026 - 14:58 nvd

HIGH 8.1

DescriptionCVE.org

Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vulnerability in the self-hosted server component where the POST /configure endpoint modifies global LLM provider and embedder configuration but only verifies authentication via JWT or X-API-Key without validating the caller's role. Any authenticated user holding a distributed API key can redirect all LLM and embedder traffic to an attacker-controlled server, with the malicious configuration persisted to PostgreSQL and surviving server restarts to affect all users and API keys on the instance.

AnalysisAI

Authorization bypass in Mem0 self-hosted server versions through 0.2.8 allows any authenticated holder of a distributed API key to overwrite the global LLM and embedder configuration via the POST /configure endpoint, redirecting all model traffic to an attacker-controlled server. The malicious configuration is persisted to PostgreSQL and survives restarts, affecting every user and API key on the instance. Publicly available exploit code exists and a vendor patch has been released in commit ae7f406.

Technical ContextAI

Mem0 is an open-source memory layer for AI agents whose self-hosted server (cpe:2.3:a:mem0ai:mem0) exposes an HTTP API protected by JWT or X-API-Key authentication. The vulnerable POST /configure endpoint manages instance-wide LLM provider and embedder settings backed by PostgreSQL, but its handler only checks that the caller is authenticated - not that the caller holds an administrative role. This is a textbook CWE-862 Missing Authorization flaw: an authorization decision (administrative configuration change) is conflated with authentication (possessing any valid API key), so a privilege-tier check that should gate the endpoint is simply absent.

RemediationAI

Upgrade to the Mem0 build containing the fix commit ae7f4062652df1376990221101d1adbb0819c973 (merged via PR https://github.com/mem0ai/mem0/pull/5360); this is an upstream fix available as a commit, and a tagged release version beyond 0.2.8 is not independently confirmed from the provided data. Until the patched build is deployed, operators should block or reverse-proxy the POST /configure endpoint so only administrator identities can reach it, audit recently issued API keys and rotate any that are over-privileged or unaccounted for, and inspect the persisted LLM/embedder configuration in PostgreSQL to confirm the provider URL still points to a trusted endpoint - note that restricting /configure will prevent legitimate runtime reconfiguration through the API and may require config changes to be made directly in the database. Review the related pgvector image migration guide at https://docs.mem0.ai/migration/server-pgvector-upgrade if upgrading the server stack at the same time.