CVE-2026-31242

Name of the Vulnerable Software and Affected Versions mem0 version 1.0.0

Description The server lacks authentication and authorization controls for the memory reset functionality. An unauthenticated attacker can send a DELETE request to the '/memories' endpoint, which triggers a reset operation that executes a DROP TABLE SQL statement. This action deletes the entire memory database table, resulting in catastrophic data loss and a complete denial of service for all users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.