CVE-2026-75110: MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled (AUTH_ENABLED=

MemOS, a memory system for LLMs and AI agents, has a critical authentication bypass vulnerability when authentication is enabled but an undocumented environment variable called INTERNAL_SERVICE_SECRET is not set. An attacker can exploit this by sending requests without proper authentication headers, causing the system to incorrectly treat them as trusted internal requests and grant full administrative access, allowing them to create API keys, steal data, and gain persistent control.