CVE-2026-116575— Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)

Quick assessment

Affected

mem0ai mem0

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Mem0 为 AI 智能体和应用提供持久化内存基础设施。在 Python SDK 2.0.18 和 TypeScript SDK 3.1.6 之前，中的函数以及 TypeScript SDK 中的方法，在使用未转义的和作为分隔符时，直接拼接了由调用方控制的、和值。攻击者可利用此漏洞，在受控的标识符中嵌入另一个作用域组件，使得不同租户的三元组生成相同的键。由于、以及 REST API 的接口均依赖该键来读取和保存原始消息，因此可能导致跨租户对话内容泄露，或造成其他租户的历史记录被意外驱逐或交错

CVSS 6.3 · Medium Updated Oct 27, 2026

Possible ATT&CK Techniques 3 AI

T1078 · Valid Accounts T1083 · File and Directory Discovery T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)

Source: CVE Program / CVE List V5

Vulnerability Description

Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_session_scope() in mem0/memory/main.py and Memory.buildSessionScope() in the TypeScript SDK join caller-controlled user_id, agent_id, and run_id values using unescaped & and = delimiters. A caller can embed another scope component in a controlled identifier so that distinct tenant tuples produce the same session_scope key. Memory.add(), AsyncMemory.add(), and the REST POST /memories flow use that key to read and save recent raw messages, allowing cross-tenant conversation disclosure and eviction or interleaving of another tenant's history. This issue is fixed in Python SDK 2.0.18 and TypeScript SDK 3.1.6.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

信息暴露

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
mem0ai	mem0	< 2.0.18	-

II. Public POCs for CVE-2026-116575

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116575

请登录查看更多情报信息。

Other References for CVE-2026-116575 (5)

https://github.com/mem0ai/mem0/pull/6892 x_refsource_MISC
https://github.com/mem0ai/mem0/releases/tag/v2.0.18 x_refsource_MISC
https://github.com/mem0ai/mem0/releases/tag/ts-v3.1.6 x_refsource_MISC
https://github.com/mem0ai/mem0/security/advisories/GHSA-5324-3w58-qpp2 x_refsource_CONFIRM
https://github.com/mem0ai/mem0/commit/71f2ebefa3494da21550fb525216818776cde67f x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-116575

IV. Related Vulnerabilities

Same product: mem0

Same vendor: mem0ai

Same weakness: CWE-200