{"id":"CVE-2026-115324","kind":"vulnerability","aliases":["CVE-2026-115324","GHSA-7587-9684-52r6"],"related":[],"title":"mem0ai Databricks vector store vulnerable to SQL injection","description":"mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert() and update() string interpolation to execute injected SQL on the configured Databricks SQL warehouse.","summary":"mem0ai's Databricks vector store builds SQL by string interpolation in its insert and update paths, so memory text, metadata, or message names can carry injected SQL. An attacker who can influence stored memory content can run arbitrary SQL against the configured Databricks SQL warehouse.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mem0ai","fixed":["1.0.8"],"affected":">= 0.1.117, < 1.0.8","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-tooling","cwe-89","databricks","llm-memory","mem0","python","sql-injection"],"not_affected_if":["mem0ai<0.1.117","mem0ai>=1.0.8","no-untrusted-memory-input","not-using-databricks-vector-store","pinned-below-0.1.117"],"how_to_check":"Run: pip show mem0ai (or pip list | grep mem0ai); vulnerable if version is >= 0.1.117 and < 1.0.8. Only exposed if your mem0 config uses the Databricks vector store (vector_store provider 'databricks' in the Memory config / config file; code uses mem0/vector_stores/databricks.py). Then check whether untrusted users can influence memory text, metadata, or message names passed to add()/update(); if so, treat as exposed.","fix":"Upgrade mem0ai to 1.0.8 or later (pip install -U 'mem0ai>=1.0.8'). Fix is commit a2ffca3 (PR #4558). Until upgraded: stop untrusted input reaching memory add/update on the Databricks store, and run the SQL warehouse credentials with least privilege.","status":"open","published_at":"2026-10-22T11:17:51+00:00","first_seen_at":"2026-10-23T20:59:05+00:00","triaged_at":"2026-10-23T21:00:12+00:00","updated_at":"2026-10-23T21:57:31+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-10-23T21:00:12Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade the mem0ai package to 1.0.8 or later (affected range is 0.1.117 before 1.0.8).\nIf upgrading is delayed, restrict who or what can write memories to the Databricks-backed store.","reach":"unknown","impact":"high","summary":"mem0ai's Databricks vector store builds SQL by string interpolation in its insert and update paths, so memory text, metadata, or message names can carry injected SQL. An attacker who can influence stored memory content can run arbitrary SQL against the configured Databricks SQL warehouse.","category":"ai-tooling","who_cares":["python","mem0","databricks","llm-memory"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary SQL on the Databricks SQL warehouse via memory content","analyst_note":"Check whether memory writes can be driven by untrusted end users and confirm the exact fix commit at https://github.com/advisories/GHSA-7587-9684-52r6; sources do not say how to check exposure.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-using-databricks-vector-store","pinned-below-0.1.117"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000514,"input_tokens":2860,"output_tokens":455,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check whether memory writes can be driven by untrusted end users and confirm the exact fix commit at https://github.com/advisories/GHSA-7587-9684-52r6; sources do not say how to check exposure.","search":"'-115324':11A,19A '-2026':10A,18A '-52':15A '-7587':13A '-89':25B '-9684':14A '0.1.117':81C '1.0.8':83C 'ai':22B 'ai-tool':21B 'allow':92C 'arbitrari':72B 'attack':63B,93C,102C 'build':40B 'carri':59B 'configur':76B,126C 'contain':84C 'content':69B,101C 'craft':105C 'cve':9A,17A 'cwe':24B 'databrick':2A,26B,37B,77B,127C 'execut':121C 'ghsa':12A 'influenc':66B,98C 'inject':8A,34B,60B,87C,95C,122C 'insert':47B,115C 'interpol':44B,119C 'llm':28B 'llm-memori':27B 'mem0':30B,80C 'mem0/vector_stores/databricks.py':90C 'mem0ai':1A,20A,35B 'memori':29B,52B,68B,100C,106C 'messag':56B,110C 'metadata':54B,108C 'name':57B,111C 'path':50B 'python':31B 'r6':16A 'reach':113C 'run':71B 'sql':7A,33B,41B,61B,73B,78B,86C,96C,123C,128C 'sql-inject':32B 'store':4A,39B,67B,99C 'string':43B,118C 'suppli':104C 'text':53B,107C 'tool':23B 'unescap':114C 'updat':49B,117C 'vector':3A,38B 'vulner':5A,88C 'warehous':79B,129C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T11:17:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-7587-9684-52r6","url":"https://github.com/advisories/GHSA-7587-9684-52r6","severity":"critical","published_at":"2026-10-22T12:31:17+00:00","modified_at":"2026-10-23T20:52:53+00:00","first_seen_at":"2026-10-23T20:59:05+00:00","fetched_at":"2026-10-23T20:59:05+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115324:81","url":null,"severity":null,"published_at":"2026-10-23T21:27:58+00:00","modified_at":"2026-10-23T21:27:58+00:00","first_seen_at":"2026-10-23T21:27:58+00:00","fetched_at":"2026-10-23T21:27:58+00:00","note":"Read GHSA, fix commit a2ffca3 (PR #4558, 2026-03-26) and v1.0.8 release; fix commit confirmed. No PoC or exploitation seen in sources; did not check X. CVSS 4.0 9.2 but AC:High/AT:Present."},{"source":"nvd","external_id":"CVE-2026-115324","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115324","severity":null,"published_at":"2026-10-22T11:17:51+00:00","modified_at":"2026-10-22T17:39:56+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null}],"documents":[{"id":1024,"url":"https://github.com/advisories/GHSA-7587-9684-52r6","title":"GHSA-7587-9684-52r6 mem0ai Databricks SQLi","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1025,"url":"https://github.com/mem0ai/mem0/commit/a2ffca3","title":"Fix commit a2ffca3 (PR #4558)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1026,"url":"https://github.com/mem0ai/mem0/releases/tag/v1.0.8","title":"mem0 v1.0.8 release","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}