CVE-2026-31242: Mem0: kritik işlevde kimlik doğrulaması eksik

Açıklama (NVD)

The mem0 v1.0.0 server lacks authentication and authorization controls for its memory reset functionality accessible via the DELETE /memories endpoint. An unauthenticated attacker can send a DELETE request that triggers a reset operation, leading to the execution of a DROP TABLE SQL statement. This results in the deletion of the entire memory database table, causing catastrophic data loss and a complete denial of service for all users of the service.

Özet bilgiler

Ürün

Mem0 Mem0

CVSS v3.1

9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

EPSS

%0,49 (yüzdelik 42)

CWE

CWE-306

Yama

Geçici çözüm

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• github.com
• www.notion.so
• CWE-306