Executive brief
Mem0 is a memory layer for AI applications that stores and manages context for LLMs. A security flaw in its self-hosted server allows any user with a valid API key to change the system's global configuration. An attacker could use this to redirect all AI traffic to their own server, allowing them to steal sensitive conversation data, prompts, and personal information from every user on the platform.
Technical details
A missing authorization check in the 'POST /configure' endpoint of the Mem0 self-hosted server allows any authenticated user (via JWT or X-API-Key) to modify global LLM provider and embedder configurations. While the server implements a 'verify_auth' dependency, it fails to validate the user's role, allowing non-admin API key holders to execute administrative configuration changes. An attacker can redirect all LLM and embedding traffic to an external malicious endpoint, enabling full data exfiltration of prompts and memories. The malicious configuration is persisted to the PostgreSQL database and survives server restarts. This was fixed in commit ae7f406 by implementing role-based access control.
Affected products
- mem0ai Mem0 through 0.2.8
Timeline
- 2026-05-12: disclosed: Vulnerability discovered and reported via GitHub issues.
- 2026-06-05: patched: Fixed in commit ae7f406 and PR #5360.
- 2026-06-09: advisory: CVE-2026-49948 published.