CVE-2026-116575: Mem0 session scope key injection vulnerability

CVE-2026-116575 · Severity: medium · CVSS 6.3 · Published 2026-10-26

Mem0 is a memory infrastructure platform for AI agents that stores conversation history keyed by session identifiers. An attacker who controls user_id, agent_id, or run_id values can embed delimiter characters to make different tenant combinations produce the same session key, allowing them to read another tenant's conversation history, delete it, or interleave it with their own.

Technologies: mem0ai (PyPI). Vendors: npm, PyPI.

Quick answers

Is CVE-2026-116575 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-116575 being exploited in the wild.
How severe is CVE-2026-116575?
Medium severity, with a CVSS score of 6.3, published 26 October 2026.
Which products and versions are affected?
Mem0 Python SDK before 2.0.18; Mem0 TypeScript SDK before 3.1.6; mem0ai (npm) < 3.1.6, SEMVER:introduced=0,fixed=3.1.6; mem0ai (PyPI) < 2.0.18, ECOSYSTEM:introduced=0,fixed=2.0.18.
Is there a fix for CVE-2026-116575?
Yes. mem0ai (npm): upgrade to 3.1.6 or later; mem0ai (PyPI): upgrade to 2.0.18 or later. Until then: Upgrade to Python SDK 2.0.18 or TypeScript SDK 3.1.6. Note that identifiers containing %, &, or = characters will experience a one-time reset of their recent-conversation buffer on the first add() call after upgrade, but stored memories are unaffected.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-10-26", "note": "CVE-2026-116575 published" }, { "kind": "patched", "at": "2026-08-11", "note": "Fix committed with delimiter escaping applied to Python and TypeScript SDKs" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116575 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-116575?
Check whether you run Mem0 Python SDK, Mem0 TypeScript SDK, mem0ai (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mem0ai (npm): upgrade to 3.1.6 or later
    npm install mem0ai@3.1.6
  • mem0ai (PyPI): upgrade to 2.0.18 or later
    pip install "mem0ai>=2.0.18"

Upgrade to Python SDK 2.0.18 or TypeScript SDK 3.1.6. Note that identifiers containing %, &, or = characters will experience a one-time reset of their recent-conversation buffer on the first add() call after upgrade, but stored memories are unaffected.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-10-26", "note": "CVE-2026-116575 published" }, { "kind": "patched", "at": "2026-08-11", "note": "Fix committed with delimiter escaping applied to Python and TypeScript SDKs" } ]

Technical details

The vulnerability is a session key collision in _build_session_scope() (Python) and Memory.buildSessionScope() (TypeScript), which constructs the session key by joining user-controlled identifiers with unescaped & and = delimiters. An attacker can inject these delimiters into their identifier values to create ambiguous keys that collide with other tenants' keys. The Memory.add(), AsyncMemory.add(), and REST POST /memories endpoints use this key to manage the recent-conversation buffer, exposing cross-tenant data leakage and history manipulation without requiring authentication beyond the ability to supply identifiers.

Affected products

  • Mem0 Python SDK before 2.0.18
  • Mem0 TypeScript SDK before 3.1.6

Identifiers

  • CVE-2026-116575
  • GHSA-5324-3w58-qpp2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.