---
id: "CVE-2026-115324"
kind: "vulnerability"
aliases: ["CVE-2026-115324", "GHSA-7587-9684-52r6"]
title: "mem0ai Databricks vector store vulnerable to SQL injection"
severity: "critical"
cvss: 9.2
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "mem0ai", "fixed": ["1.0.8"], "affected": ">= 0.1.117, < 1.0.8", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["ai-tooling", "cwe-89", "databricks", "llm-memory", "mem0", "python", "sql-injection"]
not_affected_if: ["mem0ai<0.1.117", "mem0ai>=1.0.8", "no-untrusted-memory-input", "not-using-databricks-vector-store", "pinned-below-0.1.117"]
published_at: "2026-10-22T11:17:51+00:00"
first_seen_at: "2026-10-23T20:59:05+00:00"
updated_at: "2026-10-23T21:57:31+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-7587-9684-52r6", "first_seen_at": "2026-10-23T20:59:05+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:27:58+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115324", "first_seen_at": "2026-10-23T21:57:31+00:00"}]
---

# mem0ai Databricks vector store vulnerable to SQL injection

mem0ai's Databricks vector store builds SQL by string interpolation in its insert and update paths, so memory text, metadata, or message names can carry injected SQL. An attacker who can influence stored memory content can run arbitrary SQL against the configured Databricks SQL warehouse.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:mem0ai affected >= 0.1.117, < 1.0.8 fixed 1.0.8

## How to check

Run: pip show mem0ai (or pip list | grep mem0ai); vulnerable if version is >= 0.1.117 and < 1.0.8. Only exposed if your mem0 config uses the Databricks vector store (vector_store provider 'databricks' in the Memory config / config file; code uses mem0/vector_stores/databricks.py). Then check whether untrusted users can influence memory text, metadata, or message names passed to add()/update(); if so, treat as exposed.

## Fix

Upgrade mem0ai to 1.0.8 or later (pip install -U 'mem0ai>=1.0.8'). Fix is commit a2ffca3 (PR #4558). Until upgraded: stop untrusted input reaching memory add/update on the Databricks store, and run the SQL warehouse credentials with least privilege.

## Timeline

- 2026-10-23T20:59:05+00:00 ghsa https://github.com/advisories/GHSA-7587-9684-52r6
- 2026-10-23T21:27:58+00:00 analyst — Read GHSA, fix commit a2ffca3 (PR #4558, 2026-03-26) and v1.0.8 release; fix commit confirmed. No PoC or exploitation seen in sources; did not check X. CVSS 4.0 9.2 but AC:High/AT:Present.
- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115324

## Documents

- [advisory] GHSA-7587-9684-52r6 mem0ai Databricks SQLi https://github.com/advisories/GHSA-7587-9684-52r6
- [fix] Fix commit a2ffca3 (PR #4558) https://github.com/mem0ai/mem0/commit/a2ffca3
- [fix] mem0 v1.0.8 release https://github.com/mem0ai/mem0/releases/tag/v1.0.8

## From the sources

mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert() and update() string interpolation to execute injected SQL on the configured Databricks SQL warehouse.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_