mem0 agent-memory server: unauthenticated memory read/write + plaintext LLM-key disclosure (CVE-2026-59705 / CVE-2026-59706)
Disclosed vulnerability07 Jul 2026Two critical vulnerabilities were disclosed on 7 July 2026 in mem0 (mem0ai), a widely adopted open-source long-term-memory layer for AI agents (reportedly ~60k GitHub stars), affecting its openmemory/api component prior to commit a3154d5. Per NVD and the VulnCheck advisories, CVE-2026-59705 (CWE-306 Missing Authentication; CVSS 3.1 9.8) stemmed from API routers registered without authentication middleware, letting an unauthenticated attacker read, write, and delete arbitrary users' stored memories by supplying an arbitrary user_id, or invoke a pause endpoint with global_pause=true to deny memory service across all users. CVE-2026-59706 (CVSS 3.1 9.3) covered unauthenticated config endpoints that reportedly returned stored LLM API keys (e.g. OpenAI keys) in plaintext via a config GET, and allowed server-side request forgery by setting an attacker-controlled ollama_base_url to internal targets such as a cloud instance-metadata service. Endpoint paths and parameter names here are illustrative of the disclosed classes rather than an operational exploit. The pair is a concrete example of the agent memory store itself — not the model or a prompt-injection channel — being the attack surface: an unauthenticated network attacker could poison an agent's persistent memory, exfiltrate both stored memories and provider credentials, and disrupt service. mem0 shipped a fix in commit a3154d5.
Risks it illustrates
Sources
- NVD — CVE-2026-59705 (mem0 openmemory unauthenticated memory access, CWE-306) ↗
- NVD — CVE-2026-59706 (mem0 plaintext LLM-key exposure + SSRF via ollama_base_url) ↗
- VulnCheck advisory — mem0 openmemory/api unauthenticated access via memory endpoints ↗
- VulnCheck advisory — mem0 SSRF and plaintext API-key exposure via unauthenticated config endpoints ↗
Practise the risk class — related scenarios
Interactive simulations of the risk class this case illustrates (not a re-enactment of this specific event).
An ops agent gets one god-mode credential — and one misread wipes production
A coding agent asks to write ./notes.txt — the file it actually overwrites is your SSH keys
A team of agents agrees its way into a confidently wrong answer — and a runaway loop
A support email hides instructions — and the assistant obeys them
A text-to-SQL agent runs the model's output straight at the database
A jailbroken agent decomposes one malicious goal into hundreds of harmless-looking steps — and per-step filters never see the attack
A poisoned issue makes the agent lie to the human who approves its actions
A speed optimisation becomes a cross-tenant listening device
Two doors to the same secret: reconstruct the model through its API, or just walk off with the weight file
Told it's being shut down, an agent reaches for leverage — with no attacker in sight
The forensic record is itself the attack surface — an agent's log is poisoned, then quietly rewritten
A 'safe' dataset preview turns an upload into code execution on the pipeline's workers
A newsletter the user asked to summarise quietly writes a false 'fact' into the agent's long-term memory — and it detonates weeks later
A shopping page tells the agent to do something the user never asked for
One click provisions an attacker-configured agent inside your own workspace
A single poisoned document plants a standing instruction that survives every reset
Encoded public text is laundered across an agent handoff into an on-chain transfer
A screenshot that's harmless at full size becomes an order once the system shrinks it
An attacker captures the agent's bearer token — and inherits its authority
A forged peer registers on the agent directory — and the planner enlists it
A poisoned web page hijacks a research agent — and the planner acts on its behalf
A GUI agent clicks 'Continue' — but the screen moved, and it lands on 'Send'
An inbox summary quietly ships a secret to an attacker's server