CVE-2026-59163Patch

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/sync_server.py parsed the JWT's header and payload using base64 decoding, then passed the token to a jwt library call with options that effectively disabled signature verification. The server accepted any well-formed token regardless of the signature, including tokens with alg: none and tokens signed with the wrong key. The fix in v3.10.1 replaces the broken decode with a from-scratch HS256 verifier using only the Python standard library. For users who cannot upgrade immediately, restrict network access to the sync server endpoint to trusted clients only. Firewall, reverse proxy with mTLS, or localhost bind with SSH tunnel are all viable. The vulnerability is not exploitable against an unreachable endpoint.

Back to dashboard

0.8/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-347

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
10 mentions across 9 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 5 signals
Technical details provided in 10 signals
Disclosure: 5 classified signals
Peaked 7d ago at 2 mentions (2026-09-22); latest day: 1
10 total mentions across 9 days

Deep dive

Activity timeline10 mentions / 9d

Signal classification2 categories

Patch

550.0%

Disclosure

550.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-21	1	Patch1
2026-09-22	2	Disclosure1Patch1
2026-09-23	1	Disclosure1
2026-09-24	1	Disclosure1
2026-09-25	1	Patch1
2026-09-26	1	Patch1
2026-09-27	1	Disclosure1
2026-09-28	1	Patch1
2026-09-29	1	Disclosure1

Full discourse10 posts

Prateek Tomar@Prateektomar40d
Patch
Critical vulnerability alert: CVE-2026-59163 with a CVSS score of 9.1. Mnemosyne is a memory layer for artificial intelligence.... Security teams should prioritize patching this one. Details: https://threatops.tech/exploit-radar #CVE #InfoSec #VulnMgmt
Post summary
The text issues a critical alert for CVE-2026-59163 with a high CVSS score and explicitly recommends patching as a priority. Technical details are provided, but no exploit code or active exploitation is mentioned.
0001162
135 followersView on X
Prateek Tomar@Prateektomar37d
Disclosure
New critical CVE to watch: CVE-2026-59163 with a CVSS score of 9.1. Mnemosyne is a memory layer for artificial intelligence.... If you're affected, patch as soon as possible. Details: https://threatops.tech/exploit-radar #CVE #InfoSec #VulnMgmt
Post summary
The tweet announces a new critical CVE with a CVSS score of 9.1 and advises affected users to patch, linking to further details.
0000030
136 followersView on X
Prateek Tomar@Prateektomar38d
Patch
Critical vulnerability alert: CVE-2026-59163 with a CVSS score of 9.1. Mnemosyne is a memory layer for artificial intelligence.... Security teams should prioritize patching this one. Details: https://threatops.tech/exploit-radar #CVE #InfoSec #VulnMgmt
Post summary
The tweet announces CVE-2026-59163 as a critical vulnerability with a CVSS 9.1, explicitly urges immediate patching, and provides a link to additional exploit details.
0000030
135 followersView on X
Prateek Tomar@Prateektomar39d
Disclosure
CVE-2026-59163 just dropped with a CVSS score of 9.1. Mnemosyne is a memory layer for artificial intelligence.... This is a serious one that needs immediate attention. Details: https://threatops.tech/exploit-radar #CVE #InfoSec #VulnMgmt
Post summary
The text announces a new vulnerability (CVE-2026-59163) affecting Mnemosyne with a high CVSS score, urging urgency but providing no PoC, exploit tool, patch, or evidence of active exploitation within the post.
0000042
135 followersView on X
Prateek Tomar@Prateektomar41d
Patch
Critical vulnerability alert: CVE-2026-59163 with a CVSS score of 9.1. Mnemosyne is a memory layer for artificial intelligence.... Security teams should prioritize patching this one. Details: https://threatops.tech/exploit-radar #CVE #InfoSec #VulnMgmt
Post summary
The post alerts on a critical vulnerability (CVE-2026-59163, CVSS 9.1) in the Mnemosyne AI memory layer and explicitly urges security teams to prioritize patching.
0000042
135 followersView on X
Prateek Tomar@Prateektomar42d
Disclosure
CVE-2026-59163 just dropped with a CVSS score of 9.1. Mnemosyne is a memory layer for artificial intelligence.... This is a serious one that needs immediate attention. Details: https://threatops.tech/exploit-radar #CVE #InfoSec #VulnMgmt
Post summary
The tweet announces CVE-2026-59163 with a CVSS 9.1 score and provides a link for more details, indicating a disclosure of the vulnerability without mentioning patches, exploits, or active use.
0000036
135 followersView on X
Prateek Tomar@Prateektomar43d
Disclosure
Critical vulnerability alert: CVE-2026-59163 with a CVSS score of 9.1. Mnemosyne is a memory layer for artificial intelligence.... Security teams should prioritize patching this one. Details: https://threatops.tech/exploit-radar #CVE #InfoSec #VulnMgmt
Post summary
The tweet alerts about CVE-2026-59163, a critical vulnerability (CVSS 9.1) in Mnemosyne, and urges security teams to prioritize patching, providing a link for further details.
0000044
133 followersView on X
Prateek Tomar@Prateektomar44d
Disclosure
New critical CVE to watch: CVE-2026-59163 with a CVSS score of 9.1. Mnemosyne is a memory layer for artificial intelligence.... If you're affected, patch as soon as possible. Details: https://threatops.tech/exploit-radar #CVE #InfoSec #VulnMgmt
Post summary
The text announces a new critical vulnerability (CVE-2026-59163) with technical context and a CVSS score of 9.1, advising users to patch, but does not name a specific fix or provide exploit/PoC details.
0000040
134 followersView on X
Cybersecurity News DE@cybsecuritynews44d
Patch
#schwachstellen CVE-2026-59163: Kritische Authentifizierungslücke in Mnemosyne vor Version 3.10.1 #cve202659163 #hs256 #jwt #mnemosyne https://cybersecurity-news.de/cve-2026-59163-mnemosyne-jwt-authentifizierungsluecke
Post summary
The tweet announces CVE-2026-59163 as a critical JWT authentication vulnerability in Mnemosyne and indicates version 3.10.1 as the fixed release, with limited technical detail in the post itself.
0000029
13 followersView on X
Orizon Signals@OrizonSignals45d
Patch
CVE-2026-59163: Mnemosyne sync server decoded JWT tokens but skipped HMAC-SHA256 signature checks, letting any well-formed token impersonate a user. First step: confirm your deployment actually verifies signatures, not just token structure. https://github.com/advisories/GHSA-xcw4-53cc-hv32 https://t.co/Wv7ONIdjVK
Post summary
The tweet discloses CVE-2026-59163, a JWT signature verification bypass in Mnemosyne sync server, and advises users to verify their deployments enforce signature checks, linking to the GitHub advisory for further details.
0000040
1 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-59163

Prateek Tomar[verified]@PrateektomarPatch

The text issues a critical alert for CVE-2026-59163 with a high CVSS score and explicitly recommends patching as a priority. Technical details are provided, but no exploit code or active exploitation is mentioned.