Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-49948— Mem0 0.2.8 Missing Authorization via POST /configure Endpoint

Quick assessment

Affected

mem0ai mem0

Exploitation

Public or AI PoC available; prioritize validation

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

mem0是Mem0开源的一个高效记忆算法基准测试工具。 Mem0 0.2.8及之前版本存在安全漏洞，该漏洞源于缺少授权验证，可能导致任何持有API密钥的认证用户重定向所有LLM和嵌入器流量到攻击者控制的服务器。以下版本受到影响：0.2.8及之前版本。

CVSS 8.1 · High EPSS 0.53% · P44 Updated Jul 15, 2026

Possible ATT&CK Techniques 2 AI

T1136.001 · Local Account T1098.004 · SSH Authorized Keys

Affected Version Matrix 2

Vendor	Product	Version Range	Status
mem0ai	mem0	`≤ 0.2.8`	affected
		`ae7f4062652df1376990221101d1adbb0819c973`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-49948

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Mem0 0.2.8 Missing Authorization via POST /configure Endpoint

Source: CVE Program / CVE List V5

Vulnerability Description

Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vulnerability in the self-hosted server component where the POST /configure endpoint modifies global LLM provider and embedder configuration but only verifies authentication via JWT or X-API-Key without validating the caller's role. Any authenticated user holding a distributed API key can redirect all LLM and embedder traffic to an attacker-controlled server, with the malicious configuration persisted to PostgreSQL and surviving server restarts to affect all users and API keys on the instance.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Vulnerability Title

mem0 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
mem0ai	mem0	0 ~ 0.2.8	-

II. Public POCs for CVE-2026-49948

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

Qwen3.6-35B-A3B · 7285 chars

Pro+ exclusive includes:

Vulnerability reproduction recording (real sandbox build + trigger, exclusive)

In-depth vulnerability mechanism

Trigger conditions & impact

Full executable POC code

Exploit chain & mitigation

POC zip download

100+ AI POC generations per month

Upgrade to Pro+ to unlock Limited ¥499/month ¥599 Sign up first

III. Intelligence Information for CVE-2026-49948

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-49948 (3)

Vendor Advisories for CVE-2026-49948 (1)

🔗 Mem0 0.2.8 Missing Authorization via POST /configure Endpoint | Advisories | VulnCheck Read full article third-party-advisory

Proof of Concept for CVE-2026-49948 (1)

🔗 Missing Authorization on POST /configure Allows Any API Key Holder to Hijack Global LLM Configuration · Issue #5127 · mem0ai/mem0 Read full article technical-description exploit

https://www.cve.org/CVERecord?id=CVE-2026-49948

IV. Related Vulnerabilities

Same product: mem0

Same vendor: mem0ai

Same weakness: CWE-862