Which versions of mem0 are affected by CVE-2026-59706?

mem0's self-hosted server contains an authentication bypass vulnerability that exposes LLM provider credentials (such as OpenAI API keys) and internal infrastructure to remote unauthenticated…. A patch is available.

How to fix or mitigate CVE-2026-59706?

24 hours: Search mem0 access logs for requests to /api/v1/config/ endpoints to identify unauthorized access; isolate affected servers if evidence of compromise is found. 7 days: Apply the latest mem0 security patch from the vendor; immediately rotate all LLM provider API keys stored in mem0 or used by the server; check for unauthorized API usage in cloud provider and LLM service accounts. 30 days: Implement network segmentation to restrict API access; deploy API authentication/authorization; conduct forensic review of server logs and cloud audit trails for indicators of compromise.

mem0 CVE-2026-59706

Q: What is the CVSS score of CVE-2026-59706?

CVE-2026-59706 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42106 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-07 VulnCheck

GHSA-225m-p565-9h68

Authentication Bypass SSRF Mem0

9.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.3 CRITICAL

Unauthenticated remote endpoint (PR:N/AC:L) leaks API keys (C:H) and SSRF reaches internal systems, changing scope (S:C); config write gives limited integrity impact (I:L).

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 22:00 vuln.today

DescriptionCVE.org

mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request forgery via attacker-controlled ollama_base_url parameter. Unauthenticated attackers can retrieve stored secrets like OpenAI API keys via GET /api/v1/config/ or trigger SSRF attacks by setting ollama_base_url to internal addresses like cloud IMDS via PUT /api/v1/config/mem0/llm endpoint.

AnalysisAI

Sensitive information disclosure and server-side request forgery in mem0's self-hosted server let unauthenticated remote attackers steal stored LLM provider credentials and pivot into internal infrastructure. Because the /api/v1/config/ endpoints require no authentication (CWE-306), an attacker can GET plaintext secrets such as OpenAI API keys and PUT a malicious ollama_base_url to coerce the server into requesting internal-only addresses like cloud instance metadata (IMDS). CVSS 4.0 rates this 9.2 (Critical); there is no public exploit identified at time of analysis, but the attack is trivial and reported by VulnCheck.

Technical ContextAI

mem0 (mem0ai/mem0) is an open-source memory layer for AI agents that persists and retrieves contextual memories, backed by configurable LLM and embedding providers. The vulnerable component is the server's configuration REST API, which exposes GET /api/v1/config/ and PUT /api/v1/config/mem0/llm without an authentication or authorization check - the CWE-306 (Missing Authentication for Critical Function) root cause. The config store holds provider API keys in plaintext, so a read of the endpoint returns live credentials. Separately, the llm config accepts an ollama_base_url value that the server subsequently uses to make outbound HTTP requests; with no allowlist or SSRF guard, an attacker-supplied internal URL (e.g., http://169.254.169.254/ cloud IMDS) is fetched by the server, classic SSRF against link-local and internal endpoints.

RemediationAI

Upstream fix available (PR/commit); a released patched version is not independently confirmed from the available data - apply the vendor fix in commit a3154d59e52386d4e1189c1f5f44819868f76514 (https://github.com/mem0ai/mem0/commit/a3154d59e52386d4e1189c1f5f44819868f76514) by upgrading to a build that includes it, and consult the VulnCheck advisory and issue #6081 for guidance. Until patched, do not expose the mem0 config API to untrusted networks: bind the server to localhost or place it behind an authenticating reverse proxy, and restrict or block access to the /api/v1/config/ routes at the proxy/firewall (this prevents credential reads and config writes but breaks any legitimate remote config management). Because SSRF targets cloud metadata, enforce IMDSv2 and block egress from the mem0 host to 169.254.169.254 and other internal ranges (side effect: any intended internal integrations must be explicitly allowlisted). As a precaution, rotate any LLM/provider API keys that were stored in an exposed instance, since they may already be compromised.