CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-75110 — MemOS is a memory operating system for LLMs and AI agents. In deployments where ...

·Source: NIST NVD

Updated:

Executive Summary

MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled (AUTH_ENABLED=true) but the undocumented, defaultless INTERNAL_SERVICE_SECRET environment variable is unset, the is_internal_request() check in src/memos/api/middleware/auth.py fails open: os.getenv("INTERNAL_SERVICE_SECRET") returns None and a request omitting the X-Internal-Service header al

Analysis

MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled (AUTH_ENABLED=true) but the undocumented, defaultless INTERNAL_SERVICE_SECRET environment variable is unset, the is_internal_request() check in src/memos/api/middleware/auth.py fails open: os.getenv("INTERNAL_SERVICE_SECRET") returns None and a request omitting the X-Internal-Service header also yields None, so the comparison None == None evaluates true. The request is then treated as a trusted internal principal and granted scopes: ["all"]. As a result, an unauthenticated remote attacker can reach the admin API-key management endpoints to mint API keys for any user, enumerate keys, revoke keys, and generate a master key for persistent privileged access, as well as all data endpoints. CVSS Score: 9.8. Published: 2026-08-17T21:16:50.043.

Indicators of Compromise (1)

CVE (1)
CVE-2026-75110
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 17, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Would I lie to you? ANZ warns of troubling ‘scam-coaching’ trend

ANZ is warning customers about a troubling rise in 'scam‑coaching' – a tactic where criminals train victims to bypass bank security by giving them scripts, cover stories, and instructions on how to respond to bank staff.

Finextra
MEDIUMVulnerabilityNEW

Korea's Jeonbuk Bank to deploy Ripple Payments for cross-border remittances

Ripple, the leading provider of blockchain-based enterprise solutions across traditional and digital finance, today announced a partnership with Jeonbuk Bank, making it the first regional bank in Korea to deploy Ripple Payments for cross-border remittances, bringing near real-time settlement to businesses that have historically relied on transfers taking days to complete.

Finextra
MEDIUMVulnerabilityNEW

Xceptor extends SaaS offering to Switzerland and Japan

Xceptor, a global leader in data automation for capital markets, today announced it has launched sovereign-grade SaaS in Switzerland and Japan, two of the world’s most demanding markets.

Finextra