# CVE-2026-31245: mem0ai mem0 missing authentication in memory creation API

Source: https://junglewise.ai/threats/cve-2026-31245-mem0ai-mem0-missing-authentication-in-memory-creation-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-31245 · Severity: medium · CVSS 5.3 · Published 2026-05-12

Mem0 is a memory layer used by AI agents to store and retrieve information. A security flaw in the Mem0 server allows anyone on the network to add new information to the database without providing a password or identity. This could allow an attacker to inject false or malicious data into an AI's memory, potentially corrupting its decision-making or polluting the system's data.

Technologies: [mem0ai (PyPI)](https://junglewise.ai/threats/technologies/mem0ai). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-31245 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-31245 being exploited in the wild.

**How severe is CVE-2026-31245?** Medium severity, with a CVSS score of 5.3, published 12 May 2026.

**Which products and versions are affected?** mem0ai (PyPI) <= 1.0.0, ECOSYSTEM:introduced=0,last_affected=1.0.0.

**Is there a fix for CVE-2026-31245?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-31245 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-31245?** Check whether you run mem0ai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The mem0 server (version 1.0.0 and earlier) contains a vulnerability where the 'POST /memories' API endpoint does not implement authentication or authorization checks (CWE-306, CWE-862). A remote, unauthenticated attacker can send crafted HTTP POST requests to this endpoint to create new memory records. This allows for unauthorized data injection and data pollution within the database used by AI agents. The vulnerability is exploitable over the network with low complexity and requires no user interaction. As of the advisory date, no patched version has been identified.

## Affected products

- mem0ai mem0ai <= 1.0.0

## Identifiers

- CVE-2026-31245
- GHSA-cgx8-qgvr-f7vf
- PYSEC-2026-2633

## Timeline

- 2026-05-12: advisory: GHSA-cgx8-qgvr-f7vf published
- 2026-05-12: disclosed: CVE-2026-31245 assigned

## References

- [https://github.com/mem0ai/mem0](https://github.com/mem0ai/mem0)
- [https://www.notion.so/CVE-2026-31245-35d1e1393188810aab57ff9b49146b05](https://www.notion.so/CVE-2026-31245-35d1e1393188810aab57ff9b49146b05)

## Related threats

- [Mem0 session scope key injection vulnerability](https://junglewise.ai/threats/cve-2026-116575-mem0-provides-persistent-memory-infrastructure-for-ai-agents-and)
- [mem0 SQL injection in Databricks vector store](https://junglewise.ai/threats/cve-2026-115324-mem0-0-1-117-before-1-0-8-contains-an-sql-injection)
- [mem0 server missing authentication in memory deletion API](https://junglewise.ai/threats/cve-2026-31241-mem0-server-missing-authentication-in-memory-deletion-api)
- [mem0ai mem0 missing authentication in memory management API](https://junglewise.ai/threats/cve-2026-31240-mem0ai-mem0-missing-authentication-in-memory-management-api)
- [PYSEC-2026-2636 - mem0ai mem0 has an Improper Input Validation Issue](https://junglewise.ai/threats/cve-2026-7597-mem0ai-mem0-has-an-improper-input-validation-issue)