CVE-2026-116575: Mem0 SDK session scope collision in add() exposes cross-tenant conversations

Summary

Mem0's Python SDK before 2.0.18 and TypeScript SDK before 3.1.6 build session scope keys by joining caller-controlled user_id, agent_id, and run_id values with unescaped & and = delimiters in _build_session_scope() and Memory.buildSessionScope(). A caller can embed another scope component in an identifier so that distinct tenant tuples yield the same session_scope key, which Memory.add(), AsyncMemory.add(), and POST /memories use to read and save recent raw messages. This enables cross-tenant conversation disclosure and eviction or interleaving of another tenant's history.

Mitigation

Fixed in Python SDK 2.0.18 and TypeScript SDK 3.1.6.

Topics

• AI agents

Related items

• MediumOpenAI’s August fix for theft of reasoning traces was quickly bypassedSimilar attack · CSO Online
• LowStolen AI Reasoning Could Help China Build Cheaper RivalsSimilar attack · SecurityWeek
• HighCVE-2026-110474: CreditNirvana Agentic AI Call Centre hardcoded API key in client-side JavaScriptSimilar attack · NVD/CVE Database
• InfoFrom Speech Tokens to Stolen Voices: Attacker-Chosen-Text Speaker Impersonation via Representation InversionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoBeyond membership inference: Distributional leakage in diffusion modelsSimilar attack · Elsevier Security Journals