CVE-2026-115324High· 8.1▾ Twilightmem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or messag…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert() and update() string interpolation to execute injected SQL on the configured Databricks SQL warehouse.
mem0 >= 0.1.117 < 1.0.8Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-59705Critical· 9.8mem0 - OpenMemory API Unauthenticated Access via Memory Endpoints
CVE-2026-59706Critical· 9.3mem0 - Unauthenticated Config API Exposure and SSRF via ollama_base_url
CVE-2026-7597Medium· 6.3mem0ai mem0 has an Improper Input Validation Issue
CVE-2026-31240High· 7.5mem0 server lacks authentication and authorization controls for its memory management API endpoints
CVE-2026-31241Medium· 6.5mem0 server lacks authentication and authorization controls for its memory deletion API endpoint
CVE-2026-31245Medium· 5.3mem0 server lacks authentication and authorization controls for its memory creation API endpoint