CVE-2026-115324highBroken access control2026-10-22
CVE-2026-115324: Mem0's Databricks vector store built SQL from memory text, so crafted memories could inject SQL
Mem0 (mem0ai) 0.1.117 to before 1.0.8 built INSERT and UPDATE statements in its Databricks vector store by pasting memory text, metadata and message names straight into SQL. Anyone who can influence what gets stored as a memory, including through a chat with your agent, could run injected SQL on your Databricks SQL warehouse. Fixed in mem0ai 1.0.8.
What it is
insert() and update() in mem0/vector_stores/databricks.py used string interpolation without escaping for memory content, metadata and message names.
Because memories are usually extracted from user conversations, an end user who can shape what the agent remembers can reach this SQL. Only setups that use the Databricks vector store are affected.
How to check
- Affected: mem0ai (PyPI) 0.1.117 to before 1.0.8.
- You are at risk if your Mem0 config uses the databricks vector store provider.
How to fix
- Upgrade mem0ai to 1.0.8 or later.
- Until then, give the Databricks credentials Mem0 uses access only to its own vector table, not the rest of the warehouse.
pip show mem0ai | grep -i version
pip install -U 'mem0ai>=1.0.8'Sources
More advisories for this tool