CVE-2026-116575: Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)
Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, buildsessionscope() in mem0/memory/main.py and Memory.buildSessionScope() in the TypeScript SDK join caller-controlled userid, agentid, and runid values using unescaped & and = delimiters. A caller can embed another scope component in a controlled identifier so that distinct tenant tuples produce the same sessionscope key. Memory.add(), AsyncMemory.add(), and the REST POST /memories flow use that key to read and save recent raw messages, allowing cross-tenant conversation disclosure and eviction or interleaving of another tenant's history. This issue is fixed in Python SDK 2.0.18 and TypeScript SDK 3.1.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mem0 Python SDKto a version that resolves this vulnerability.Fixed in 2.0.18 - Upgrade
Upgrade
Mem0 TypeScript SDKto a version that resolves this vulnerability.Fixed in 3.1.6
Event History
Frequently Asked Questions
Which deployments are exposed to cross-tenant conversation access?
Deployments using the Mem0 Python SDK before 2.0.18 or the TypeScript SDK before 3.1.6 are affected when caller-controlled user_id, agent_id, or run_id values are used to build session scope keys. The affected flows are Memory.add(), AsyncMemory.add(), and REST POST /memories.
What does an attacker need to exploit the collision?
The attacker needs the ability to supply a user_id, agent_id, or run_id containing unescaped & or = delimiters. They can craft an identifier so that their tenant tuple resolves to the same session_scope key as another tenant.
What is the practical impact of a successful collision?
A collision can expose recent raw messages from another tenant. It can also evict or interleave another tenant's conversation history when messages are read or saved under the shared session_scope key.
How should affected deployments be remediated?
Upgrade the Python SDK to 2.0.18 or later, or the TypeScript SDK to 3.1.6 or later. These versions fix the session-scope key construction issue.