MemOS Authentication Bypass via Unset INTERNAL_SERVICE_SECRET in Middleware

Vulnerability Overview In the MemOS server, when is unset, the internal service check fails, resulting in authentication bypass. Specifically: Vulnerability Description: The authentication server wrapper ( ) protects its admin API key management endpoints using the dependency. Before verifying the key, this dependency calls to allow trusted container-to-container calls. If is not set, returns , causing to evaluate to . This treats the request as an internal service and grants without requiring any API key. Impact Scope Complete Bypass of API Key Authentication: In deployments where is enabled but is not set, unauthorized remote attackers can completely bypass authentication. Privileged Access: The bypassed principal obtains , satisfying , allowing enumeration of existing keys, revocation of keys (Denial of Service), generation of master keys, and use of these keys for persistent privileged access. Affected Components: - File: - Functions: (line 154) and (line 182) - Consumers: (each route via or ) - Deployment: ( ) Remediation Fix Method: In , treat an unset key as disabled and require a non-empty match: Use Constant-Time Comparison: Use to prevent timing leaks. Apply Dependency: Apply (or appropriate ) to data endpoints to protect them when . POC Code Observations Case [A]: Demonstrates that an unauthorized external request is granted as an internal principal, satisfying and unlocking any endpoint. Case [B]: Confirms that the gate works correctly; the vulnerability specifically fails when comparing two different values (i.e., fails). Environment Information Docker Additional Information No Response Implementation Willingness I am willing to implement it myself I hope others will implement it Tags Assignees Memtensor-Ai WeiminLee sysuzshine219 Type No Type Project No Project Milestones No Milestones Relationships No Relationships Development No Branches or Pull Requests Participants Open in GitHub Copilot app Comments Memtensor-Ai added the , , labels, 1 day ago Memtensor-Ai assigned and , 1 day ago Memtensor-Ai added the label, 1 day ago Memtensor-Ai self-assigned this, 1 day ago Memtensor-Ai 1 day ago - AutoDev has picked up this issue and started working. - Task ID: - Working Branch: - Target Branch: branch - Workflow: - I will post here after this PR is linked. If more information is needed, I will ask in the comments. Memtensor-Ai added commits referencing this issue, 1 day ago - Memtensor-Ai mentioned this issue, 1 day ago - Fix #2259: Authentication Bypass in MemOS Server: Internal Service Check Failure When is Unset Memtensor-Ai 1 day ago - AutoDev task is complete. - Summary: Closed the fail-open authentication bypass reported in GHSA-9p6f-vmxg-qgwx by . In every deployed deployment, is unset, so returns , and normal external requests also produce from . Consequently, authorizes anonymous callers as internal principals with , satisfying on every route. - The fix reads the key into a local variable, returns if the key or header is missing/empty, and compares the two non-empty strings using for constant-time equality. The allowlist branch remains unchanged. - Public APIs, request/response models, configuration schemas, Dockerfiles, Helm charts, and documentation deployments—always from deployments where the key is unset—simply lose the unsafe header path usage. - Added , containing 12 regression test cases: reproducing the exact fail-open scenarios of all failing unpatched baselines (all failing unpatched baselines as expected), one asserting that is called, plus positive path and end-to-end coverage, running the advisor POC against . After all 12 pass, the advisor POC now returns 401 Missing API key for both header-missing and header-wrong external requests. checks and formatting are clean on both changed files. Neighbor tests ( , , ) remain green, existing fails on the same unpatched baseline (missing marker in this CI environment) and is unrelated to this change. - Note: The reporter also observed a second issue: the mounted in lacks dependencies on data endpoints. This changes public routes ( "Ask first list"), and is deferred to a separate issue—this PR intentionally keeps its scope focused on the primary fail-open issue #2259. - Base Branch: - Branch: - Commit: - PR: - Assigned to: - Reviewers: Memtensor-Ai added the , labels and removed the , , labels, 1 day ago LEEKIYOON-SEC mentioned this issue, 1 day ago - Register Free Registration to join this GitHub conversation. Already have an account? Login to comment Footer © 2026 GitHub, Inc. Terms Privacy Security Status Community Docs Contact Manage cookies Do not share my personal information

Goal Reached Thanks to every supporter — we hit 100%!

MemOS Authentication Bypass via Unset INTERNAL_SERVICE_SECRET in Middleware

More from this source