SQL Injection Vulnerability in mem0 AI's Databricks Integration

github.com

SQL Injection Vulnerability in mem0 AI's Databricks Integration

First seen 23 Oct 2026, 08:42 UTC • •78.0

Article Content

1 / 5

Browse articles

ThreatCluster •October 23, 2026 at 09:42 UTC

•CVE-2026-115324 is a critical SQL injection vulnerability with a CVSS score of 9.2.
•The vulnerability affects mem0 versions before 1.0.8, specifically in the Databricks vector store.
•Mitigation steps include upgrading to the fixed version and reviewing warehouse query logs.

A SQL injection vulnerability (CVE-2026-115324) was identified in mem0 version 0.1.117 before 1.0.8, affecting the Databricks vector store implementation. The flaw allows attackers to inject malicious SQL through unescaped f-string interpolation in the insert() and update() methods, potentially leading to data exposure or disruption. The vulnerability was disclosed on October 22, 2026, with a CVSS score of 9.2, marking it as. Users of the Databricks vector store integration are particularly at risk, especially where untrusted content can be supplied. The recommended mitigation includes upgrading to the fixed version, disabling the integration, and restricting access to the warehouse. No exploitation in the wild has been reported yet, but the complexity of the attack may limit immediate threats. Users are advised to review logs for suspicious activity until a patch is applied.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-10-22

CVE-2026-115324 published

The critical SQL injection vulnerability in mem0 was disclosed, affecting Databricks integration.

Redpacketsecurity

More articles in this cluster (4)

Threat Graph

5 entities, 4 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Sql Injection
T1190 - Exploit Public-Facing Application

Vulnerability (1)

CVE-2026-115324

Weakness (1)

CWE-89 - SQL Injection

Affected Platform (1)

Databricks

Relationships

CVE-2026-115324 targets Databricks
Sql Injection targets Databricks
T1190 - Exploit Public-Facing Application targets Databricks
CVE-2026-115324 related to CWE-89 - SQL Injection

Following this threat?

Track CVE-2026-115324 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

What versions are affected?

Versions of mem0 before 1.0.8 are affected by this SQL injection vulnerability.

Is there a patch available?

Yes, users are advised to upgrade to mem0 version 1.0.8 or later to mitigate the vulnerability.

What should I do if I can't upgrade immediately?

Consider disabling the Databricks integration and reviewing query logs for suspicious activity until you can upgrade.

Continue Reading

Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…

Critical SQL Injection Zero-Day in Arista VeloCloud Orchestrator Exploited Arista Networks has patched a critical zero-day vulnerability (CVE-2026-114625) in its VeloCloud Orchestrator (VCO) that is actively being exploited. The flaw allows authenticated users, even those with basic privileges, to escalate their access to superuser status via a low-complexity SQL injection attack. This…