Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.0.18, 3.1.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
Mem0, a persistent memory library and REST service for AI agents, is affected in its Python SDK (before 2.0.18) and TypeScript SDK (before 3.1.6). Attackers who control user, agent, or run identifiers could craft them so that different tenants map to the same internal session key, allowing one tenant to read another tenant's recent conversation messages or have their history overwritten or mixed with someone else's.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_session_scope() in mem0/memory/main.py and Memory.buildSessionScope() in the TypeScript SDK join caller-controlled user_id, agent_id, and run_id values using unescaped & and = delimiters. A caller can embed another scope component in a controlled identifier so that distinct tenant tuples produce the same session_scope key. Memory.add(), AsyncMemory.add(), and the REST POST /memories flow use that key to read and save recent raw messages, allowing cross-tenant conversation disclosure and eviction or interleaving of another tenant's history. This issue is fixed in Python SDK 2.0.18 and TypeScript SDK 3.1.6.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- mem0ai mem0
fixed in 2.0.18
- mem0aiPyPI
fixed in 2.0.18
- mem0ainpm
fixed in 3.1.6