6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31241

CVE-2026-31241: mem0 server lacks authentication and authorization controls for its memory deletion API endpoint

The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories). The endpoint allows unauthenticated users to delete memory records by specifying arbitrary user identifiers (e.g., user_id, run_id, agent_id) in the request query parameters. A remote attacker can exploit this by sending unauthenticated DELETE requests to erase memory data for any user, leading to unauthorized data loss and denial of service.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31241

CVE-2026-31241:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mem0ai	pip	<= 1.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described is a missing authentication on the DELETE /memories API endpoint. Based on the provided file server/main.py, the function delete_all_memories is the handler for this endpoint. The description of the vulnerability states that it's unauthenticated, which means that in the vulnerable version, the _auth=Depends(verify_auth) dependency is likely missing from the function definition. This allows an attacker to delete memories of any user by simply providing their user ID in the request, leading to data loss and denial of service. The analysis of the code confirms that the function takes user identifiers as parameters and performs a deletion operation based on them. The primary evidence is the vulnerability description, which is consistent with the code's functionality, assuming the authentication check was absent in the vulnerable version.

Vulnerable functions

delete_all_memories

server/main.py

The `delete_all_memories` function is responsible for handling the `DELETE /memories` API endpoint. According to the vulnerability description, this endpoint lacks authentication in the vulnerable versions. This would allow an unauthenticated attacker to call this function and delete memories associated with any user by specifying their `user_id`, `run_id`, or `agent_id` in the request. The function signature `def delete_all_memories(user_id: Optional[str] = None, run_id: Optional[str] = None, agent_id: Optional[str] = None, _auth=Depends(verify_auth):` confirms that it accepts these identifiers. The vulnerable version of this function would not have the `_auth=Depends(verify_auth)` parameter, thus allowing unauthenticated access.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.