Critical Vulnerability in openmemory/api (CVE-2026-59705)
An unauthenticated access vulnerability has been reported in the openmemory/api component, allowing attackers to manipulate user memories and cause denial-of-service.
What happened
An early warning has been issued regarding a critical vulnerability (CVE-2026-59705) in the openmemory/api component of the mem0 package. This vulnerability reportedly allows unauthenticated attackers to read, write, and delete arbitrary user memories by exploiting API endpoints that lack authentication middleware. Attackers can also cause a denial-of-service condition across all users by invoking specific endpoints. The vulnerability affects a wide range of versions, from v0.0.23 to v2.0.4 and various TypeScript and CLI versions. It is recommended to upgrade to a patched version as soon as it becomes available and to review access controls for API endpoints. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8. For more details, consult the primary sources.
How 0Day mitigates this
openmemory/api is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.