Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by accessing API routers registered without authentication middleware. Attackers can supply arbitrary user_id parameters or directly access memory retrieval endpoints to expose private memory content, or invoke pause endpoints with global_pause=true to cause denial-of-service across all users.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-07 | 1 | Disclosure1 |
| 2026-07-08 | 3 | Disclosure2Patch1 |
🚨 CVE-2026-59705 — CVSS 9.8/10 ██████████ mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/OkAFL4Ep6U
Post summary
The tweet highlights CVE-2026-59705 as a critical, high‑CVSS vulnerability involving unauthenticated access and states that a patch is currently available.
🚨 CRITICAL - Unauthenticated API router exposure enables arbitrary memory access + global pause DoS (CVE-2026-59705) mem0’s openmemory/api component registers API routers without authentication middleware, leaving sensitive memory endpoints exposed to the internet. The root cause is missing access control/authentication enforcement (improper authorization / insecure default routing). An attacker can exploit this remotely with no credentials by supplying arbitrary user_id values or directly calling memory retrieval/write/delete endpoints, and can also invoke pause endpoints with global_pause=true to halt service. Impact includes full read/write/delete of arbitrary user memories (private data exposure and tampering) and a global denial of service affecting all users. 👉 Affected: mem0ai (openmemory/api; all versions with unauthenticated router registration) | Upgrade to No fix yet - treat as suspicious
Post summary
The text announces CVE-2026-59705, a critical security flaw in mem0’s openmemory/api that allows unauthenticated access to memory endpoints and a global DoS. No patch is available yet, and the issue is recommended for immediate attention.
🚨*CVE* CVE-2026-59705 mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memor… https://www.cve.org/CVERecord?id=CVE-2026-59705 ----- Traducción: CVE-2026-59705 mem… http://infoflow.cloud`
Post summary
The post announces CVE-2026-59705, describing an unauthenticated access flaw in mem0’s openmemory/api that permits reading, writing, and deleting arbitrary user memory, and links to the official CVE record.
CVE-2026-59705 mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memor… https://www.cve.org/CVERecord?id=CVE-2026-59705
Post summary
The post announces CVE-2026-59705, describing an unauthenticated access flaw in mem0's openmemory/api allowing arbitrary read, write, and delete of user memory, with no mention of PoC, exploit code, active exploitation, or mitigation.