CVE-2026-116575: Mem0 could mix up two users' conversation history, leaking one tenant's messages to another
Mem0's Python and TypeScript SDKs built the key for each session's recent messages by joining user_id, agent_id and run_id with unescaped & and = characters. A caller who controls only their own run_id or agent_id could craft a value that produces another tenant's key, then read that tenant's recent raw messages and write into their history. Fixed in Python SDK 2.0.18 and TypeScript SDK 3.1.6.
What it is
_build_session_scope() in mem0/memory/main.py (and Memory.buildSessionScope() in the TypeScript SDK) joins the IDs as key=value pairs separated by &, and the only validation rejects empty strings. So a run_id like proj-x&user_id=alice produces exactly the same key as the real user alice with run_id proj-x.
Memory.add(), AsyncMemory.add() and the REST POST /memories flow use that key to load and save the last raw messages. The advisory says an attacker's next add() pulls the victim's prior conversation (which can include personal data or credentials) into the attacker's own fact-extraction prompt, and can also evict or interleave the victim's history.
This matters most for apps that pass a client- or session-supplied identifier straight through as run_id or agent_id, which the advisory calls a very common integration shape.
How to check
- Affected: mem0ai on PyPI before 2.0.18 and mem0ai on npm before 3.1.6.
- You are at risk if more than one user or tenant shares one Mem0 store and any of user_id, agent_id or run_id can be set by the end user.
How to fix
- Upgrade mem0ai to 2.0.18 or later (Python) or 3.1.6 or later (TypeScript).
- Until then, generate run_id and agent_id on your server instead of taking them from the client, or reject IDs that contain & or =.
pip show mem0ai | grep -i version
npm ls mem0ai