{"id":"CVE-2026-116575","kind":"vulnerability","aliases":["CVE-2026-116575"],"related":[],"title":"Mem0 SDK: crafted user IDs leak another tenant's conversation history","description":"Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_session_scope() in mem0/memory/main.py and Memory.buildSessionScope() in the TypeScript SDK join caller-controlled user_id, agent_id, and run_id values using unescaped & and = delimiters. A caller can embed another scope component in a controlled identifier so that distinct tenant tuples produce the same session_scope key. Memory.add(), AsyncMemory.add(), and the REST POST /memories flow use that key to read and save recent raw messages, allowing cross-tenant conversation disclosure and eviction or interleaving of another tenant's history. This issue is fixed in Python SDK 2.0.18 and TypeScript SDK 3.1.6.","summary":"Mem0's Python and TypeScript SDKs build a session key by joining user_id, agent_id and run_id with unescaped delimiters, so distinct tenants can collide on the same key. An attacker who controls an identifier can read or disrupt another tenant's recent raw messages.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","mem0","multi-tenant","python","typescript"],"not_affected_if":["server-assigned-ids","single-tenant"],"how_to_check":"- Check the installed Python SDK version with `pip show mem0ai` and the TypeScript SDK with `npm ls mem0ai`\n- Look for application code that passes end-user-controlled values into `user_id`, `agent_id` or `run_id` on `Memory.add()`, `AsyncMemory.add()` or `POST /memories`","fix":"- Upgrade the Python SDK to `2.0.18` or later\n- Upgrade the TypeScript SDK to `3.1.6` or later\n- Until upgraded, validate that scope identifiers do not contain `&` or `=`","status":"open","published_at":"2026-10-26T21:18:13+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","triaged_at":"2026-10-26T21:21:14+00:00","updated_at":"2026-10-26T21:21:14+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-26T21:21:14Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Python SDK to `2.0.18` or later\n- Upgrade the TypeScript SDK to `3.1.6` or later\n- Until upgraded, validate that scope identifiers do not contain `&` or `=`","reach":"internet","title":"Mem0 SDK: crafted user IDs leak another tenant's conversation history","impact":"medium","summary":"Mem0's Python and TypeScript SDKs build a session key by joining user_id, agent_id and run_id with unescaped delimiters, so distinct tenants can collide on the same key. An attacker who controls an identifier can read or disrupt another tenant's recent raw messages.","category":"ai-tooling","nicknames":[],"who_cares":["python","typescript","mem0","multi-tenant","ai-agents"],"confidence":0.7,"needs_auth":"yes","worst_case":"Another tenant's conversation history is read or interleaved","analyst_note":"Confirm whether the hosted Mem0 platform is affected and whether the NVD entry lists the affected version range; check the advisory for the exact auth requirement.","how_to_check":"- Check the installed Python SDK version with `pip show mem0ai` and the TypeScript SDK with `npm ls mem0ai`\n- Look for application code that passes end-user-controlled values into `user_id`, `agent_id` or `run_id` on `Memory.add()`, `AsyncMemory.add()` or `POST /memories`","needs_analyst":true,"not_affected_if":["single-tenant","server-assigned-ids"],"who_is_affected":"Applications that let end users or other tenants influence the user_id, agent_id or run_id values sent to Mem0 are exposed, because a crafted identifier can map onto another tenant's session key. Single-tenant deployments where these values are fully server-chosen are much less exposed. The sources do not say whether the hosted Mem0 platform is affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000695,"input_tokens":3490,"output_tokens":692,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116575':14A,17A '-2026':13A,16A '/memories':151C '2.0.18':91C,185C '3.1.6':95C,189C 'agent':20B,44B,84C,113C 'ai':19B,22B,83C 'ai-ag':18B 'ai-tool':21B 'allow':163C 'anoth':7A,71B,127C,174C 'applic':86C 'asyncmemory.add':146C 'attack':62B 'build':36B,96C 'caller':109C,124C 'caller-control':108C 'collid':56B 'compon':129C 'control':64B,110C,132C 'convers':10A,167C 'craft':3A 'cross':165C 'cross-ten':164C 'cve':12A,15A 'delimit':51B,122C 'disclosur':168C 'disrupt':70B 'distinct':53B,136C 'emb':126C 'evict':170C 'fix':181C 'flow':152C 'histori':11A,177C 'id':5A,43B,45B,48B,112C,114C,117C 'identifi':66B,133C 'infrastructur':81C 'interleav':172C 'issu':179C 'join':41B,107C 'key':39B,60B,144C,155C 'leak':6A 'mem0':1A,24B,30B,77C 'mem0/memory/main.py':100C 'memori':80C 'memory.add':145C 'memory.buildsessionscope':102C 'messag':76B,162C 'multi':26B 'multi-ten':25B 'persist':79C 'post':150C 'prior':87C 'produc':139C 'provid':78C 'python':28B,32B,89C,183C 'raw':75B,161C 'read':68B,157C 'recent':74B,160C 'rest':149C 'run':47B,116C 'save':159C 'scope':98C,128C,143C 'sdk':2A,90C,94C,106C,184C,188C 'sdks':35B 'session':38B,97C,142C 'tenant':8A,27B,54B,72B,137C,166C,175C 'tool':23B 'tupl':138C 'typescript':29B,34B,93C,105C,187C 'unescap':50B,120C 'use':119C,153C 'user':4A,42B,111C 'valu':118C","nicknames":[],"mitigations":[],"who_affected":"Applications that let end users or other tenants influence the user_id, agent_id or run_id values sent to Mem0 are exposed, because a crafted identifier can map onto another tenant's session key. Single-tenant deployments where these values are fully server-chosen are much less exposed. The sources do not say whether the hosted Mem0 platform is affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:18:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116575","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116575","severity":null,"published_at":"2026-10-26T21:18:13+00:00","modified_at":"2026-10-26T21:18:13+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","fetched_at":"2026-10-26T21:20:31+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}