Is CVE-2026-49948 actively exploited?

No active exploitation of CVE-2026-49948 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-49948 be exploited remotely?

Yes. CVE-2026-49948 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-49948?

CVE-2026-49948 has a CVSS score of 8.1 (HIGH).

HOME VULNERABILITIESCVE-2026-49948

HIGH

CVE-2026-49948

CWE-862Published: June 9, 2026· Updated: Jun 9, 2026

8.1

CVSS v3.1

Official Description

Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vulnerability in the self-hosted server component where the POST /configure endpoint modifies global LLM provider and embedder configuration but only verifies authentication via JWT or X-API-Key without validating the caller's role. Any authenticated user holding a distributed API key can redirect all LLM and embedder traffic to an attacker-controlled server, with the malicious configuration persisted to PostgreSQL and surviving server restarts to affect all users and API keys on the instance.

NVD Source

Technical Analysis

CVE-2026-49948 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 8.1.