Is CVE-2026-115324 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115324 being exploited in the wild.

How severe is CVE-2026-115324?

High severity, with a CVSS score of 8.1, published 22 October 2026.

Which products and versions are affected?

Mem0ai Mem0 0.1.117 before 1.0.8; mem0ai (PyPI) >= 0.1.117, < 1.0.8, ECOSYSTEM:introduced=0.1.117,fixed=1.0.8.

Is there a fix for CVE-2026-115324?

Yes. mem0ai (PyPI): upgrade to 1.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-115324 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-115324?

Check whether you run Mem0ai Mem0 or mem0ai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115324: mem0 SQL injection in Databricks vector store

Q: Is there a fix for CVE-2026-115324?

Yes. mem0ai (PyPI): upgrade to 1.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-115324 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-115324?

Check whether you run Mem0ai Mem0 or mem0ai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115324 · Severity: high · CVSS 8.1 · Published 2026-10-22

mem0 is an open-source memory management library for AI agents that stores contextual information. A SQL injection vulnerability in its Databricks integration allows attackers to execute arbitrary SQL commands on the configured Databricks warehouse by crafting malicious memory content, potentially leading to data theft, modification, or deletion.

Technologies: Mem0ai Mem0, mem0ai (PyPI). Vendors: Mem0ai, PyPI.

Quick answers

Is CVE-2026-115324 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115324 being exploited in the wild.
How severe is CVE-2026-115324?: High severity, with a CVSS score of 8.1, published 22 October 2026.
Which products and versions are affected?: Mem0ai Mem0 0.1.117 before 1.0.8; mem0ai (PyPI) >= 0.1.117, < 1.0.8, ECOSYSTEM:introduced=0.1.117,fixed=1.0.8.
Is there a fix for CVE-2026-115324?: Yes. mem0ai (PyPI): upgrade to 1.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115324 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-115324?: Check whether you run Mem0ai Mem0 or mem0ai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mem0ai (PyPI): upgrade to 1.0.8 or later
```
pip install "mem0ai>=1.0.8"
```

Technical details

The vulnerability exists in mem0/vector_stores/databricks.py where insert() and update() operations use unescaped string interpolation to build SQL queries. An attacker can inject SQL code through stored memory text, metadata, or message names that are concatenated directly into queries without proper parameterization. The attack requires the ability to supply or influence memory content stored in the system.

Affected products

mem0ai mem0 0.1.117 before 1.0.8

Identifiers

CVE-2026-115324
GHSA-7587-9684-52r6

Timeline

2026-10-22: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.