# CVE-2026-116575: Mem0 session scope key injection vulnerability

Source: https://junglewise.ai/threats/cve-2026-116575-mem0-provides-persistent-memory-infrastructure-for-ai-agents-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-116575 · Severity: medium · CVSS 6.3 · Published 2026-10-26

Mem0 is a memory infrastructure platform for AI agents that stores conversation history keyed by session identifiers. An attacker who controls user_id, agent_id, or run_id values can embed delimiter characters to make different tenant combinations produce the same session key, allowing them to read another tenant's conversation history, delete it, or interleave it with their own.

Technologies: [mem0ai (PyPI)](https://junglewise.ai/threats/technologies/mem0ai). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-116575 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116575 being exploited in the wild.

**How severe is CVE-2026-116575?** Medium severity, with a CVSS score of 6.3, published 26 October 2026.

**Which products and versions are affected?** Mem0 Python SDK before 2.0.18; Mem0 TypeScript SDK before 3.1.6; mem0ai (npm) < 3.1.6, SEMVER:introduced=0,fixed=3.1.6; mem0ai (PyPI) < 2.0.18, ECOSYSTEM:introduced=0,fixed=2.0.18.

**Is there a fix for CVE-2026-116575?** Yes. mem0ai (npm): upgrade to 3.1.6 or later; mem0ai (PyPI): upgrade to 2.0.18 or later. Until then: Upgrade to Python SDK 2.0.18 or TypeScript SDK 3.1.6. Note that identifiers containing %, &, or = characters will experience a one-time reset of their recent-conversation buffer on the first add() call after upgrade, but stored memories are unaffected.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-10-26",
    "note": "CVE-2026-116575 published"
  },
  {
    "kind": "patched",
    "at": "2026-08-11",
    "note": "Fix committed with delimiter escaping applied to Python and TypeScript SDKs"
  }
] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116575 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-116575?** Check whether you run Mem0 Python SDK, Mem0 TypeScript SDK, mem0ai (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mem0ai (npm): upgrade to 3.1.6 or later

  ```sh
  npm install mem0ai@3.1.6
  ```

- mem0ai (PyPI): upgrade to 2.0.18 or later

  ```sh
  pip install "mem0ai>=2.0.18"
  ```


Upgrade to Python SDK 2.0.18 or TypeScript SDK 3.1.6. Note that identifiers containing %, &, or = characters will experience a one-time reset of their recent-conversation buffer on the first add() call after upgrade, but stored memories are unaffected.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-10-26",
    "note": "CVE-2026-116575 published"
  },
  {
    "kind": "patched",
    "at": "2026-08-11",
    "note": "Fix committed with delimiter escaping applied to Python and TypeScript SDKs"
  }
]

## Technical details

The vulnerability is a session key collision in _build_session_scope() (Python) and Memory.buildSessionScope() (TypeScript), which constructs the session key by joining user-controlled identifiers with unescaped & and = delimiters. An attacker can inject these delimiters into their identifier values to create ambiguous keys that collide with other tenants' keys. The Memory.add(), AsyncMemory.add(), and REST POST /memories endpoints use this key to manage the recent-conversation buffer, exposing cross-tenant data leakage and history manipulation without requiring authentication beyond the ability to supply identifiers.

## Affected products

- Mem0 Python SDK before 2.0.18
- Mem0 TypeScript SDK before 3.1.6

## Identifiers

- CVE-2026-116575
- GHSA-5324-3w58-qpp2

## References

- [https://github.com/mem0ai/mem0/commit/71f2ebefa3494da21550fb525216818776cde67f](https://github.com/mem0ai/mem0/commit/71f2ebefa3494da21550fb525216818776cde67f)
- [https://github.com/mem0ai/mem0/pull/6892](https://github.com/mem0ai/mem0/pull/6892)

## Related threats

- [mem0 SQL injection in Databricks vector store](https://junglewise.ai/threats/cve-2026-115324-mem0-0-1-117-before-1-0-8-contains-an-sql-injection)
- [mem0ai mem0 missing authentication in memory creation API](https://junglewise.ai/threats/cve-2026-31245-mem0ai-mem0-missing-authentication-in-memory-creation-api)
- [mem0 server missing authentication in memory deletion API](https://junglewise.ai/threats/cve-2026-31241-mem0-server-missing-authentication-in-memory-deletion-api)
- [mem0ai mem0 missing authentication in memory management API](https://junglewise.ai/threats/cve-2026-31240-mem0ai-mem0-missing-authentication-in-memory-management-api)
- [PYSEC-2026-2636 - mem0ai mem0 has an Improper Input Validation Issue](https://junglewise.ai/threats/cve-2026-7597-mem0ai-mem0-has-an-improper-input-validation-issue)