CVE-2026-49948 Details
Description
Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vulnerability in the self-hosted server component where the POST /configure endpoint modifies global LLM provider and embedder configuration but only verifies authentication via JWT or X-API-Key without validating the caller's role. Any authenticated user holding a distributed API key can redirect all LLM and embedder traffic to an attacker-controlled server, with the malicious configuration persisted to PostgreSQL and surviving server restarts to affect all users and API keys on the instance.
A missing authorization vulnerability has been identified in the self-hosted server component of Mem0, affecting versions through 0.2.8. The vulnerability exists in the POST /configure endpoint, which modifies global LLM provider and embedder configurations. The endpoint only verifies authentication through JWT or X-API-Key, without validating the caller's role. This allows any authenticated user with a distributed API key to redirect all LLM and embedder traffic to an attacker-controlled server. The malicious configuration is persisted in PostgreSQL, survives server restarts, and affects all users and API keys on the instance.
The vulnerability has been fixed in Mem0 version 0.2.8. Users should upgrade to this version or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 9, 2026CISA-ADP
Assessed Jun 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mem0ai/mem0/commit/ae7f4062652df1376990221101d1adbb0819c973 | [email protected] | Source CodeVendor |
| https://github.com/mem0ai/mem0/issues/5127 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/mem0ai/mem0/issues/5384 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/mem0ai/mem0/pull/5360 | [email protected] | Source CodeVendor |
| https://www.vulncheck.com/advisories/mem0-missing-authorization-via-post-configure-endpoint | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mem0 | <= 0.2.8 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 9, 2026 | New CVE Received | [email protected] |