# CVE-2026-59705: mem0 OpenMemory API unauthenticated access in memory endpoints

Source: https://junglewise.ai/threats/cve-2026-59705-mem0-openmemory-api-unauthenticated-access-in-memory-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-59705 · Severity: critical · CVSS 9.8 · Published 2026-07-07

Mem0 is a memory layer used by AI agents to store and retrieve user interactions. A security flaw in its self-hosted API component allows anyone on the network to read, modify, or delete private user data without a password. Additionally, an attacker could disable the memory service for all users simultaneously, leading to a complete service outage and loss of sensitive information.

Technologies: [Mem0ai Mem0](https://junglewise.ai/threats/technologies/mem0). Vendors: [Mem0ai](https://junglewise.ai/threats/vendors/mem0ai).

## Quick answers

**Is CVE-2026-59705 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59705 being exploited in the wild.

**How severe is CVE-2026-59705?** Critical severity, with a CVSS score of 9.8, published 7 July 2026.

**Which products and versions are affected?** Mem0ai Mem0 up to and including commit a3154d5.

**Is there a fix for CVE-2026-59705?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-59705 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59705?** Check whether you run Mem0ai Mem0 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authentication vulnerability exists in the OpenMemory self-hosted API (openmemory/api) due to API routers being registered without authentication middleware in main.py. The root cause is a failure to implement CWE-306 (Missing Authentication for Critical Function), where endpoint handlers accept a user_id parameter without verifying the caller's identity or session. Attackers can exploit this by supplying arbitrary user_id values to access private data, or by calling the /api/v1/memories/actions/pause endpoint with global_pause=true to cause a denial-of-service across all tenants. The vulnerability was identified in commit a3154d5 and affects all endpoints including memory retrieval, update, and deletion.

## Affected products

- mem0ai mem0ai/mem0 (OpenMemory API) up to and including commit a3154d5

## Timeline

- 2026-06-01: disclosed: Vulnerability reported to vendor via email
- 2026-07-03: other: Public GitHub issue opened after no vendor response
- 2026-07-07: advisory: CVE published and VulnCheck advisory released

## References

- [https://github.com/mem0ai/mem0](https://github.com/mem0ai/mem0)
- [https://github.com/mem0ai/mem0/commit/a3154d59e52386d4e1189c1f5f44819868f76514](https://github.com/mem0ai/mem0/commit/a3154d59e52386d4e1189c1f5f44819868f76514)
- [https://github.com/mem0ai/mem0/issues/6080](https://github.com/mem0ai/mem0/issues/6080)
- [https://www.vulncheck.com/advisories/mem0-openmemory-api-unauthenticated-access-via-memory-endpoints](https://www.vulncheck.com/advisories/mem0-openmemory-api-unauthenticated-access-via-memory-endpoints)

## Related threats

- [mem0 SQL injection in Databricks vector store](https://junglewise.ai/threats/cve-2026-115324-mem0-0-1-117-before-1-0-8-contains-an-sql-injection)
- [mem0ai mem0 missing authentication in memory deletion API](https://junglewise.ai/threats/cve-2026-31244-mem0ai-mem0-missing-authentication-in-memory-deletion-api)
- [mem0 missing authentication in memory reset endpoint](https://junglewise.ai/threats/cve-2026-31242-mem0-missing-authentication-in-memory-reset-endpoint)
- [mem0ai mem0 missing authentication in memory management API](https://junglewise.ai/threats/cve-2026-31240-mem0ai-mem0-missing-authentication-in-memory-management-api)