---
id: "CVE-2026-116575"
kind: "vulnerability"
aliases: ["CVE-2026-116575"]
title: "Mem0 SDK: crafted user IDs leak another tenant's conversation history"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-agents", "ai-tooling", "mem0", "multi-tenant", "python", "typescript"]
not_affected_if: ["server-assigned-ids", "single-tenant"]
published_at: "2026-10-26T21:18:13+00:00"
first_seen_at: "2026-10-26T21:20:31+00:00"
updated_at: "2026-10-26T21:21:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116575", "first_seen_at": "2026-10-26T21:20:31+00:00"}]
---

# Mem0 SDK: crafted user IDs leak another tenant's conversation history

Mem0's Python and TypeScript SDKs build a session key by joining user_id, agent_id and run_id with unescaped delimiters, so distinct tenants can collide on the same key. An attacker who controls an identifier can read or disrupt another tenant's recent raw messages.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Python SDK version with `pip show mem0ai` and the TypeScript SDK with `npm ls mem0ai`
- Look for application code that passes end-user-controlled values into `user_id`, `agent_id` or `run_id` on `Memory.add()`, `AsyncMemory.add()` or `POST /memories`

## Fix

- Upgrade the Python SDK to `2.0.18` or later
- Upgrade the TypeScript SDK to `3.1.6` or later
- Until upgraded, validate that scope identifiers do not contain `&` or `=`

## Timeline

- 2026-10-26T21:20:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116575

## From the sources

Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_session_scope() in mem0/memory/main.py and Memory.buildSessionScope() in the TypeScript SDK join caller-controlled user_id, agent_id, and run_id values using unescaped & and = delimiters. A caller can embed another scope component in a controlled identifier so that distinct tenant tuples produce the same session_scope key. Memory.add(), AsyncMemory.add(), and the REST POST /memories flow use that key to read and save recent raw messages, allowing cross-tenant conversation disclosure and eviction or interleaving of another tenant's history. This issue is fixed in Python SDK 2.0.18 and TypeScript SDK 3.1.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_