MemOS EUVD-2026-60389

Exploitation requires the target MemOS deployment to have authentication turned on (AUTH_ENABLED=true) while the undocumented INTERNAL_SERVICE_SECRET environment variable is left unset - this is the exact fail-open state, and because the variable is defaultless and undocumented, the unset condition is likely present unless an operator deliberately configured it. The attacker sends a request that simply omits the X-Internal-Service header, which is trivial. What LIMITS exploitation: if an operator has set INTERNAL_SERVICE_SECRET to any value, the bug does not trigger; the instance's admin/data API must also be network-reachable by the attacker. No authentication, no user interaction, and no special client platform are required beyond the ability to send an HTTP request to the API.

The signals are strongly aligned toward high priority: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes remote, unauthenticated, no-interaction exploitation yielding full confidentiality, integrity, and availability loss, and the failure mode is a one-line logic bug that any operator can verify against the public source. There is no CISA KEV listing and no EPSS score in the provided data, and I found no published proof-of-concept, so there is no evidence of active exploitation yet - but the bar to weaponize is essentially trivial. A crucial nuance is that exploitability hinges on a configuration state (INTERNAL_SERVICE_SECRET unset while AUTH_ENABLED=true); because that variable is undocumented and defaultless, the vulnerable state is plausibly the common case for operators who enabled auth without ever knowing the secret existed, which is what makes this dangerous rather than theoretical. Given that a successful request mints a master key for persistent admin access, any team running an internet-reachable MemOS instance should treat this as urgent and immediately audit whether the secret is set. The main uncertainty is prevalence of the misconfiguration in the wild, not the severity of the outcome.

An attacker discovers an internet-reachable MemOS instance and sends a normal HTTP request to an admin API-key endpoint without any X-Internal-Service header. Because INTERNAL_SERVICE_SECRET is unset, the middleware treats the request as a trusted internal principal with scopes ['all'], and the attacker calls the key-management API to generate a master key. No proof-of-concept is publicly identified, but the attack requires only a single unauthenticated request and no special tooling given AV:N/AC:L/PR:N/UI:N.