Executive brief
The mem0 server, which provides a memory layer for AI agents, contains a security flaw in its data deletion interface. An unauthorized person can remotely delete stored memory records belonging to any user without needing a password or account. This could lead to permanent loss of AI training data and disrupt the functionality of AI agents relying on that memory.
Technical details
The mem0 server (version 1.0.0 and earlier) fails to implement authentication (CWE-306) and authorization (CWE-862) on the 'DELETE /memories' API endpoint. An attacker can send unauthenticated HTTP DELETE requests to this endpoint and specify arbitrary identifiers such as 'user_id', 'run_id', or 'agent_id' in the query parameters. Because the server does not verify the identity or permissions of the requester, it will execute the deletion for the specified records. This allows for unauthorized data modification and a denial-of-service condition by purging the memory layer used by AI agents. As of the advisory date, no patched version has been identified.
Affected products
- mem0ai mem0ai <= 1.0.0
Timeline
- 2026-05-12: disclosed: NVD Published Date
- 2026-05-12: advisory: GitHub Advisory published