CVE-2026-116575

Mem0 conversation-scope collisions can cross tenant boundaries

Mem0 · Mem0 Python and TypeScript SDKs

First documented disclosure · Review checkpoint

Summary

Distinct caller identities can map to the same recent-conversation buffer.

Severity and exploitation evidence

Medium · 6.3/10 · CVSS 3.1. Severity source.

Exploitation not established: A researcher reports an end-to-end demonstration; malicious exploitation is not established.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Unescaped delimiters in user, agent or run identifiers make concatenated scope keys ambiguous.

Conditions required

An integration that accepts attacker-controlled identifiers capable of colliding with another tenant's scope.

Potential impact

Another tenant's recent messages can enter the attacker's extraction context; history can be interleaved or evicted.

Affected versions and configurations

Python before 2.0.18; TypeScript before 3.1.6, per the CNA description.

Fix and mitigation status

Python 2.0.18; TypeScript 3.1.6.

Practical next steps

Upgrade both applicable SDKs and enforce server-owned tenant identity; test isolation across crafted identifiers.

Operating lesson

Tenant boundaries require unambiguous structured identity, not concatenated user-controlled strings.

Evidence and limits

August 11 public key-collision fix predates October 20 advisory and October 26 CVE. Special-character identifiers receive a fresh buffer after upgrading; stored vector memories are unaffected.

Sources