# CVE-2026-7597: PYSEC-2026-2636 - mem0ai mem0 has an Improper Input Validation Issue

Source: https://junglewise.ai/threats/cve-2026-7597-mem0ai-mem0-has-an-improper-input-validation-issue  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-01  
License: CC BY 4.0 with a link back

CVE-2026-7597 · Severity: medium · CVSS 6.3 · Published 2026-05-01

A vulnerability was found in mem0ai mem0 up to 1.0.11. This affects the function pickle.load/pickle.dump of the file mem0/vector_stores/faiss.py. Performing a manipulation results in deserialization. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The patch is named 62dca096f9236010ca15fea9ba369ba740b86b7a. Applying a patch is the recommended action to fix this issue.

Technologies: [mem0ai (PyPI)](https://junglewise.ai/threats/technologies/mem0ai). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-7597 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7597 being exploited in the wild.

**How severe is CVE-2026-7597?** Medium severity, with a CVSS score of 6.3, published 1 May 2026.

**Which products and versions are affected?** mem0ai (PyPI) ECOSYSTEM:introduced=0,fixed=2.0.0b2.

**Is there a fix for CVE-2026-7597?** Yes. mem0ai (PyPI): upgrade to 2.0.0b2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-7597?** Check whether you run mem0ai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mem0ai (PyPI): upgrade to 2.0.0b2 or later

  ```sh
  pip install "mem0ai>=2.0.0b2"
  ```


## Affected products

- mem0ai (PyPI) ECOSYSTEM:introduced=0,fixed=2.0.0b2

## Identifiers

- CVE-2026-7597
- GHSA-xqxw-r767-67m7
- PYSEC-2026-2636

## Related threats

- [Mem0 session scope key injection vulnerability](https://junglewise.ai/threats/cve-2026-116575-mem0-provides-persistent-memory-infrastructure-for-ai-agents-and)
- [mem0 SQL injection in Databricks vector store](https://junglewise.ai/threats/cve-2026-115324-mem0-0-1-117-before-1-0-8-contains-an-sql-injection)
- [mem0ai mem0 missing authentication in memory creation API](https://junglewise.ai/threats/cve-2026-31245-mem0ai-mem0-missing-authentication-in-memory-creation-api)
- [mem0 server missing authentication in memory deletion API](https://junglewise.ai/threats/cve-2026-31241-mem0-server-missing-authentication-in-memory-deletion-api)
- [mem0ai mem0 missing authentication in memory management API](https://junglewise.ai/threats/cve-2026-31240-mem0ai-mem0-missing-authentication-in-memory-management-api)