CVE-2026-31242

9.1 Critique

Publiée le 12/05/2026 à 20:16 · Modifiée le 20/10/2026 à 00:10 · Analysée par le NVD · Source : cve@mitre.org

Description

The mem0 v1.0.0 server lacks authentication and authorization controls for its memory reset functionality accessible via the DELETE /memories endpoint. An unauthenticated attacker can send a DELETE request that triggers a reset operation, leading to the execution of a DROP TABLE SQL statement. This results in the deletion of the entire memory database table, causing catastrophic data loss and a complete denial of service for all users of the service.

Traduire en français

Produits concernés

Mem0 mem0

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.1 Critique	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H`

Faiblesses (CWE)

CWE-306
CWE-862

Références

https://github.com/mem0ai/mem0 Product
https://www.notion.so/CVE-2026-31242-35d1e1393188819c9ebec0e684b4e656 MitigationThird Party Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories