CVE-2026-31242

The mem0 v1.0.0 server lacks authentication and authorization controls for its memory reset functionality accessible via the DELETE /memories endpoint. An unauthenticated attacker can send a DELETE request that triggers a reset operation, leading to the execution of a DROP TABLE SQL statement. This results in the deletion of the entire memory database table, causing catastrophic data loss and a complete denial of service for all users of the service.

• CWE-306
• CWE-862

• https://github.com/mem0ai/mem0Product
• https://www.notion.so/CVE-2026-31242-35d1e1393188819c9ebec0e684b4e656Mitigation, Third Party Advisory

Published

May 12, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-31237The Ludwig framework thru 0.10.4 is vulnerable to insecure d…9.8
• CVE-2026-31238The Ludwig framework thru 0.10.4 is vulnerable to insecure d…9.8
• CVE-2026-31239The mamba language model framework thru 2.2.6 is vulnerable …9.8
• CVE-2026-3124The Download Monitor plugin for WordPress is vulnerable to I…7.5
• CVE-2026-31240The mem0 1.0.0 server lacks authentication and authorization…7.5
• CVE-2026-31241The mem0 1.0.0 server lacks authentication and authorization…6.5
• CVE-2026-31243The mem0 1.0.0 server lacks authentication and authorization…6.5
• CVE-2026-31244The mem0 1.0.0 server lacks authentication and authorization…6.5
• CVE-2026-31245The mem0 1.0.0 server lacks authentication and authorization…5.3
• CVE-2026-31246GPT-Pilot thru commit 0819827ce20346ef5f25b3fe29293cb4488405…6.5
• CVE-2026-31247Docling's JATS XML backend is vulnerable to XML Entity Expan…7.5
• CVE-2026-31248Docling's METS GBS backend is vulnerable to XML Entity Expan…7.5