Secuno
ENNL
Book demo

CVE-2026-75110

MemOS vulnerability

9.8 CRITICALEPSS 0.66%
  1. Published17 Aug 2026

Description

MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled (AUTH_ENABLED=true) but the undocumented, defaultless INTERNAL_SERVICE_SECRET environment variable is unset, the is_internal_request() check in src/memos/api/middleware/auth.py fails open: os.getenv("INTERNAL_SERVICE_SECRET") returns None and a request omitting the X-Internal-Service header also yields None, so the comparison None == None evaluates true. The request is then treated as a trusted internal principal and granted scopes: ["all"]. As a result, an unauthenticated remote attacker can reach the admin API-key management endpoints to mint API keys for any user, enumerate keys, revoke keys, and generate a master key for persistent privileged access, as well as all data endpoints.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-1062528.8
Incorrect comparison in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote…
CVE-2026-203338.8
As part of Cisco's ongoing commitment to proactive security and product quality, the…
CVE-2026-923959.1
@fastify/proxy-addr is a Fastify plugin that determines a request's client address…
CVE-2026-920878.1
@fastify/auth is a Fastify plugin that composes multiple authentication and…
CVE-2026-907119.1
proxy-addr is a Node.js module that determines a request's client address behind…
CVE-2026-648368.8
ICEcoder versions through 8.1 contain a path traversal vulnerability in the…

Frequently asked

Is CVE-2026-75110 being actively exploited?

CVE-2026-75110 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.66%.

How severe is CVE-2026-75110?

CVE-2026-75110 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 0.66% probability of exploitation.

How do I fix CVE-2026-75110?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-75110 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.