CVE-2026-116575 Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-116575?
CVE-2026-116575 is a medium-severity vulnerability in mem0ai mem0, published on 26 Oct 2026.
Official description
Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_session_scope() in mem0/memory/main.py and Memory.buildSessionScope() in the TypeScript SDK join caller-controlled user_id, agent_id, and run_id values using unescaped & and = delimiters. A caller can embed another scope component in a controlled identifier so that distinct tenant tuples produce the same session_scope key. Memory.add(), AsyncMemory.add(), and the REST POST /memories flow use that key to read and save recent raw messages, allowing cross-tenant conversation disclosure and eviction or interleaving of another tenant's history. This issue is fixed in Python SDK 2.0.18 and TypeScript SDK 3.1.6.
Which versions are affected by CVE-2026-116575?
4 open source packages ship an affected version, including mem0ai.
| Package | Affected | Fixed in |
|---|---|---|
mem0ai PyPI | All versions | 2.0.18 |
mem0ai PyPI | All versions | 2.0.18 |
mem0ai npm | All versions | 3.1.6 |
mem0ai npm | All versions | 3.1.6 |
How do I fix CVE-2026-116575?
Upgrade mem0ai to a fixed version for your release line: 2.0.18 or 3.1.6.
Is CVE-2026-116575 being exploited?
There is no known exploitation of CVE-2026-116575 in the wild and no public exploit code.
Sources
Also known as GHSA-5324-3w58-qpp2.