CVE-2026-75110

Name of the Vulnerable Software and Affected Versions MemOS (affected versions not specified)

Description In deployments where authentication is enabled via AUTH ENABLED=true but the INTERNAL SERVICE SECRET environment variable is not set, the is internal request() function in src/memos/api/middleware/auth.py fails open. This occurs because the system compares a null environment variable with a missing X-Internal-Service header, resulting in a true evaluation. Consequently, unauthenticated remote requests are treated as trusted internal principals with full scopes. This allows attackers to access data endpoints and admin API-key management endpoints to enumerate, revoke, or mint API keys for any user, including the generation of a master key for persistent privileged access.

Recommendations Set the INTERNAL SERVICE SECRET environment variable to a secure value to ensure the is internal request() check functions correctly.