CVE-2026-31241

The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories). The endpoint allows unauthenticated users to delete memory records by specifying arbitrary user identifiers (e.g., user_id, run_id, agent_id) in the request query parameters. A remote attacker can exploit this by sending unauthenticated DELETE requests to erase memory data for any user, leading to unauthorized data loss and denial of service.

• CWE-306
• CWE-862

• https://github.com/mem0ai/mem0Product
• https://www.notion.so/CVE-2026-31241-35d1e139318881459ae5e6f0d7dc6f0fMitigation, Third Party Advisory

Published

May 12, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-31236The llm CLI tool thru 0.27.1 contains a critical code inject…9.8
• CVE-2026-31237The Ludwig framework thru 0.10.4 is vulnerable to insecure d…9.8
• CVE-2026-31238The Ludwig framework thru 0.10.4 is vulnerable to insecure d…9.8
• CVE-2026-31239The mamba language model framework thru 2.2.6 is vulnerable …9.8
• CVE-2026-3124The Download Monitor plugin for WordPress is vulnerable to I…7.5
• CVE-2026-31240The mem0 1.0.0 server lacks authentication and authorization…7.5
• CVE-2026-31242The mem0 v1.0.0 server lacks authentication and authorizatio…9.1
• CVE-2026-31243The mem0 1.0.0 server lacks authentication and authorization…6.5
• CVE-2026-31244The mem0 1.0.0 server lacks authentication and authorization…6.5
• CVE-2026-31245The mem0 1.0.0 server lacks authentication and authorization…5.3
• CVE-2026-31246GPT-Pilot thru commit 0819827ce20346ef5f25b3fe29293cb4488405…6.5
• CVE-2026-31247Docling's JATS XML backend is vulnerable to XML Entity Expan…7.5