Mem0 Missing Authorization on POST /configure Allowing Global LLM Config Hijack #5127

Vulnerability Overview Title: Missing Authorization on POST /configure Allows Any API Key Holder to Hijack Global LLM Configuration #5127 Description: Component: Core / Python SDK Type: Uncategorized Project: Uncategorized Milestone: Uncategorized Relation: Uncategorized Development: Uncategorized Participants: Uncategorized Summary: The vulnerability involves the modification of global LLM provider configurations (endpoint URLs, API keys). Any user holding a distributed API key can redirect LLM and embedding traffic to a server controlled by the attacker, thereby stealing prompts, memory, and embeddings from each user. Affected Versions: Repository: https://github.com/mem0ai/mem0 Component: server/ (self-hosted REST API) Branch: main (latest as of 2024-05-12) Files: - server/main.py:313-318 — vulnerable endpoint - server/auth.py:145-171 — verify_auth() never checks role - server/server_state.py:86-95 — update_config() modifies global singleton & persists to DB - server/models.py — User.role field exists but is unused Root Cause: The user model defines a role field ("admin" for the first registered user), but this field is never checked during the authorization process. Impact Scope 1. LLM Traffic Redirection and Data Exfiltration: After configuration changes, all subsequent , , and calls are sent to the attacker-controlled LLM endpoint. If the endpoint implements the expected OpenAI-compatible API, it captures user prompts, conversation context, extracted memories, and all content processed by the LLM. 2. Embedding Traffic Redirection: The attacker's endpoint also receives all embedded text (document chunks, memory contents, etc.) if it implements the embedding API. 3. Persistence: The configuration is written to PostgreSQL (the table via upsert). It persists even after a server restart. 4. Blast Radius: Global singleton — affects all users, all API keys, and all services on the instance. 5. Realistic Attack Vector: API keys are created by administrators and distributed to team members, CI pipelines, and microservices. Any leaked or compromised API key enables complete configuration takeover of the entire instance. Remediation Suggested Fix: Add a role check to the endpoint: Additional Considerations: Add a dependency for reuse across other admin-only endpoints. Audit other endpoints that should be restricted to administrators (e.g., may be safe for all users, but write operations must be restricted). Implement audit logging for configuration changes. Proof of Concept (POC) Code

Goal Reached Thanks to every supporter — we hit 100%!

Mem0 Missing Authorization on POST /configure Allowing Global LLM Config Hijack #5127

More from this source