Mem0 combined agent, run and user identifiers with unescaped delimiter characters, allowing differently structured identities to produce the same underlying memory key. The caller must be able to control identifiers containing delimiter syntax; an ordinary account cannot automatically read every other user’s memory. Colliding keys could mix recent messages…
Inspect the ClaimsCase · DiggingBeagle record
Mem0 conversation keys could collide across agent, run and user scopes
Mem0 combined agent, run and user identifiers with unescaped delimiter characters, allowing differently structured identities to produce the same underlying memory key. Colliding keys could mix recent messages into an extraction model and permit cross-principal memory reads, writes or eviction.
Scope
The caller must be able to control identifiers containing delimiter syntax; an ordinary account cannot automatically read every other user’s memory. The flaw is a structural key-serialization vulnerability in agent memory, not an observed compromise of Mem0 hosted customers.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The cited primary technical report or advisory supports the stated mechanism within its reported scope. The assessment does not infer a production breach, a victim count or a comparable impact score from a laboratory result. A maintainer or advisory names a patched release; that does not prove every deployed instance has updated. Boundary: This failure occurs before the language model makes any decision: multiple identity tuples serialize to the same session key, and the next extraction request may include another tenant’s raw message history.
Assessed Oct 29, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP23-MEM0-SESSION-DELIMITER-1 · CLM-ENRICH-20261029-12 · Mem0 agent memory session identifier collision, CVE-2026-116575
At a glance
Colliding keys could mix recent messages into an extraction model and permit cross-principal memory reads, writes or eviction.
Read the implicationsThe flaw is a structural key-serialization vulnerability in agent memory, not an observed compromise of Mem0 hosted customers.
Limits and uncertaintyFull account
Mem0 combined agent, run and user identifiers with unescaped delimiter characters, allowing differently structured identities to produce the same underlying memory key.
The caller must be able to control identifiers containing delimiter syntax; an ordinary account cannot automatically read every other user’s memory. Colliding keys could mix recent messages into an extraction model and permit cross-principal memory reads, writes or eviction.
The flaw is a structural key-serialization vulnerability in agent memory, not an observed compromise of Mem0 hosted customers. Upgrade mem0ai to 2.0.18 or the npm SDK to 3.1.6 and use unambiguous typed, length-prefixed identity tuples.
Evidence interpretation and control boundary. This failure occurs before the language model makes any decision: multiple identity tuples serialize to the same session key, and the next extraction request may include another tenant’s raw message history. The key is used by a database lookup, so hardening the LLM prompt alone cannot recover tenant isolation. Distinct typed components or length-prefixing are needed, with per-principal access enforcement independent of a caller-chosen run ID.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Claims & evidence
CLM-ENRICH-20261029-12Mem0 used unescaped ampersands and equals signs when joining agent, run and user identity fields into a conversation-history key, permitting two otherwise different tuples to address the same stored messages.supported
Basis: reported finding
- supportsMem0 agent memory session identifier collision, CVE-2026-116575primary disclosure
GHSA-5324-3w58-qpp2: collision example, session assembly, impact and fixed versions
CLM-CP23-MEM0-SESSION-DELIMITER-1Mem0 combined agent, run and user identifiers with unescaped delimiter characters, allowing differently structured identities to produce the same underlying memory key. The caller must be able to control identifiers containing delimiter syntax; an ordinary account cannot automatically read every other user’s memory. Colliding keys could mix recent messages into an extraction model and permit cross-principal memory reads, writes or eviction.supported
Basis: reported finding
- supportsMem0 agent memory session identifier collision, CVE-2026-116575primary disclosure
GHSA-5324-3w58-qpp2: collision example, session assembly, impact and fixed versions
Implications
Colliding keys could mix recent messages into an extraction model and permit cross-principal memory reads, writes or eviction.
Controls and mitigations
- Upgrade mem0ai to 2.0.18 or the npm SDK to 3.1.6 and use unambiguous typed, length-prefixed identity tuples.
Unknowns and contradictions
- The flaw is a structural key-serialization vulnerability in agent memory, not an observed compromise of Mem0 hosted customers.
Sources and citation
Material revision history
- Oct 29, 2026 · Canonical change recorded · new in release · revision 202