8.1
HighCVSS 3.1 · from VulnCheck
CVE-2026-49948
Mem0 0.2.8 Missing Authorization via POST /configure Endpoint
mem0 · Missing authorization · CWE-862Affectedmem0
FixUpdate to ae7f4062652df1376990221101d1adbb0819c973 or newer
PublishedJun 9, 14:58 · VulnCheck
ScoredJun 9 · 8.1 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
A successful attack can read data and change data. CVSS impact.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vulnerability in the self-hosted server component where the POST /configure endpoint modifies global LLM provider and embedder configuration but only verifies authentication via JWT or X-API-Key without validating the caller's role. Any authenticated user holding a distributed API key can redirect all LLM and embedder traffic to an attacker-controlled server, with the malicious configuration persisted to PostgreSQL and surviving server restarts to affect all users and API keys on the instance.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inmem0up to 0.2.8–mem0Not affectedae7f4062652df1376990221101d1adbb0819c973
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known