Is CVE-2026-31242 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-31242 being exploited in the wild.

How severe is CVE-2026-31242?

Critical severity, with a CVSS score of 9.1, published 12 May 2026.

Is there a fix for CVE-2026-31242?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-31242 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-31242?

Check whether you run Mem0ai Mem0 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-31242: mem0 missing authentication in memory reset endpoint

CVE-2026-31242 · Severity: critical · CVSS 9.1 · Published 2026-05-12

A critical security flaw exists in mem0, a memory layer used for AI agents, which allows anyone on the network to delete the entire memory database. Because the system fails to check for user identity or permissions on its reset function, an attacker can permanently erase all stored data. This results in immediate data loss and a complete shutdown of the service for all users.

Technologies: Mem0ai Mem0. Vendors: Mem0ai.

Quick answers

Is CVE-2026-31242 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-31242 being exploited in the wild.
How severe is CVE-2026-31242?: Critical severity, with a CVSS score of 9.1, published 12 May 2026.
Which products and versions are affected?: Mem0ai Mem0 1.0.0.
Is there a fix for CVE-2026-31242?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-31242 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-31242?: Check whether you run Mem0ai Mem0 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The mem0 v1.0.0 server is vulnerable to missing authentication (CWE-306) and missing authorization (CWE-862) on the 'DELETE /memories' endpoint. An unauthenticated attacker can send a specially crafted HTTP DELETE request to this endpoint, which triggers a backend reset operation. This operation executes a 'DROP TABLE' SQL statement against the memory database table. Successful exploitation results in complete data loss and a permanent denial of service (DoS) until the database schema is restored.

Affected products

mem0ai mem0 1.0.0

Timeline

2026-05-12: disclosed
2026-05-12: advisory: NVD published date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.