NVD CRITICAL: CVE-2026-59706 — mem0 contains unauthenticated config API endpoints that expose LLM API keys in p...

Tuesday, July 7, 2026 at 10:16 PM UTC·Source: NIST NVD

Updated: Tuesday, July 7, 2026 at 11:00 PM UTC

Executive Summary

mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request forgery via attacker-controlled ollama_base_url parameter. Unauthenticated attackers can retrieve stored secrets like OpenAI API keys via GET /api/v1/config/ or trigger SSRF attacks by setting ollama_base_url to internal addresses like cloud IMDS via PUT /api/v1/config/mem0/llm en

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2026-59706

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on Jul 7, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

NatWest Boxed and Mettle CTO Wayne Freeman leaves

The chief technology officer of NatWest's Boxed Banking-as-a-Service unit and its Mettle digital account for UK small businesses has stepped down.

1h agoFinextra

MEDIUMVulnerability

Italian fintech Satispay partners Mastercard for debit card launch

Italian fintech unicorn Satispay has taken another step towards building out its "superapp" by joining forces with Mastercard to launch debit cards and adding the ability to invest in stocks and ETFs.

1h agoFinextra

CRITICALVulnerability

NVD CRITICAL: CVE-2026-59705 — mem0's openmemory/api component contains an unauthenticated access vulnerability...

mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by accessing API routers registered without authentication middleware. Attackers can supply arbitrary user_id parameters or directly access memory retrieval endpoints to expose private memory content, or invoke pause endpoints wit

CVE-2026-59705

1h agoNIST NVD