---
id: CVE-2026-75110
title: MemOS is a memory operating system for LLMs and AI agents
summary: >-
  MemOS is a memory operating system for LLMs and AI agents. In deployments
  where authentication is enabled (AUTH_ENABLED=true) but the undocumented,
  defaultless INTERNAL_SERVICE_SECRET environment variable is unset, the
  is_internal_reques…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-697
vendor: MemTensor
product: MemOS
affected:
  - MemOS <= 2.0.30
published: '2026-08-17'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:06:30.133'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75110'
references:
  - url: 'https://github.com/MemTensor/MemOS'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/MemTensor/MemOS/blob/main/src/memos/api/middleware/auth.py
    label: disclosure@vulncheck.com
  - url: 'https://github.com/MemTensor/MemOS/issues/2259'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/memos-authentication-bypass-via-unset-internal-service-secret
    label: disclosure@vulncheck.com
  - url: 'https://github.com/MemTensor/MemOS/issues/2259'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00984
epssPercentile: 0.60685
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-08-18T12:48:39.747053Z'
ingestedAt: '2026-09-24T15:45:56.703Z'
---

## Overview

MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled (AUTH_ENABLED=true) but the undocumented, defaultless INTERNAL_SERVICE_SECRET environment variable is unset, the is_internal_request() check in src/memos/api/middleware/auth.py fails open: os.getenv("INTERNAL_SERVICE_SECRET") returns None and a request omitting the X-Internal-Service header also yields None, so the comparison None == None evaluates true. The request is then treated as a trusted internal principal and granted scopes: ["all"]. As a result, an unauthenticated remote attacker can reach the admin API-key management endpoints to mint API keys for any user, enumerate keys, revoke keys, and generate a master key for persistent privileged access, as well as all data endpoints.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.