CVE-2026-49948: Mem0 0.2.8 Missing Authorization via POST /configure Endpoint

Synopsis

Missing authorization vulnerability in Mem0 (the self-hosted server component) through version 0.2.8 allows any authenticated user to modify global LLM provider and embedder configuration via the POST /configure endpoint. The service is reachable over the network, and a low-privilege API key is sufficient to trigger the attack with no victim interaction required. A successful attacker redirects all LLM and embedder traffic for the entire Mem0 instance to an attacker-controlled server, with the malicious configuration persisted across restarts. A patched-image rebuild at commit ae7f4062652df1376990221101d1adbb0819c973 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Mem0 self-hosted server's HTTP API over the network to issue the POST /configure request.

• AuthenticationRequired

  A valid low-privilege account or distributed API key is sufficient; no admin or elevated role is needed because the endpoint does not validate caller role.

• Victim interactionNot required

  No user interaction is required; the attacker calls the endpoint directly with no social-engineering step.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory layout dependencies, or environmental prerequisites apply.

Blast Radius

• Reads all LLM prompt payloads and embedder inputs (which may include personal data, credentials, or proprietary text) by redirecting traffic to an attacker-controlled server.
• Modifies all LLM and embedder responses returned to every user on the instance, enabling injection of arbitrary model output.
• Persists the malicious configuration to PostgreSQL, so the redirect survives server restarts and continues to affect all API keys until the configuration is manually corrected.
• Affects the entire Mem0 instance and all tenants sharing it, not just the session of the authenticated attacker.