CVE Alert: CVE-2026-115324 – mem0ai

mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert() and update() string interpolation to execute injected SQL on the configured Databricks SQL warehouse.

**Risk verdict:** High potential impact warrants prompt review, but urgency is uncertain because KEV, SSVC, PoC and EPSS status were not supplied.

**Why this matters:** Successful injection could expose, alter or disrupt data accessible through the configured warehouse, including stored memories and potentially other data within that database context. A realistic goal is to tamper with an AI system’s retained context or extract information; disruption of warehouse operations is also possible.

**Most likely attack path:** An attacker needs a route to submit crafted content that is later processed by the affected insert or update path; network reachability is relevant, but the stated attack requirements make exploitation conditional rather than automatic. No authentication or user interaction is indicated, while high complexity remains a limiting factor. Scope is unchanged, so impact is bounded by the vulnerable service’s warehouse permissions; broader lateral movement is not implied.

**Who is most exposed:** Environments using the Databricks vector-store integration are most exposed, especially where untrusted users or external sources can supply memory content and the service account has broad warehouse access.

Review warehouse query logs for unexpected SQL syntax or anomalous writes from the application identity.

Correlate suspicious memory submissions or metadata with unusual warehouse queries.

Check for unexpected reads, modifications or deletions in application-accessible tables.

Mitigation and prioritisation:

Identify affected deployments and upgrade to the fixed release or later.

Until upgraded, disable the Databricks integration or block untrusted content from reaching it.

Restrict the warehouse identity to minimum required tables and operations; validate and parameterise inputs.

Test the change in staging, then verify dependency lockfiles and deployed runtime versions.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.