Advisory · CVE-2026-115324
mem0 Databricks vector store builds SQL from stored memory content
mem0 0.1.117 before 1.0.8 interpolates stored memory text, metadata and message names into SQL in its Databricks vector store insert and update paths, so an attacker who can influence stored memories can execute injected SQL on the configured Databricks SQL warehouse. CVSS 3.1 8.1, CVSS 4.0 9.2.
- Vendor
- mem0ai
- Product
- mem0
- Identifier / CWE
- CVE-2026-115324
CWE-89 - Action timing
- Immediate
Explain it like I’m five
mem0 saves things users said into a database by pasting the words straight into its database commands. If a saved memory contains carefully crafted punctuation, the database can mistake the memory itself for new commands.
- 01Attacker influences stored memory
An attacker supplies crafted memory text, metadata or message names through whatever application surface writes memories into mem0.
- 02Content reaches the Databricks store
The mem0 Databricks vector store handles the memory in its insert and update code.
- 03SQL is built by interpolation
Per the VulnCheck advisory, the crafted content reaches unescaped string interpolation in the insert and update paths instead of parameterized queries.
- 04Injected SQL executes
The injected SQL runs on the configured Databricks SQL warehouse with the permissions of the mem0 connection.
What happened
VulnCheck disclosed CVE-2026-115324 for the mem0 open-source memory layer: mem0 0.1.117 before 1.0.8 contains a SQL injection vulnerability in the Databricks vector store module. Per the advisory, attackers can inject SQL by influencing stored memory content, because crafted memory text, metadata or message names reach unescaped string interpolation in the insert and update paths, executing injected SQL on the configured Databricks SQL warehouse. The CVE record lists 1.0.8 as the fixed release. The CVSS 3.1 score is 8.1, with high attack complexity, and the CVSS 4.0 score is 9.2.
The exposure is specific to deployments that configure mem0 with the Databricks vector store; other vector store backends are not described as affected in the record. The entry condition is influence over content that gets stored as memory, which in agent and assistant applications can be as indirect as text a user or a retrieved document contributes to a conversation that the application saves. What the injected SQL can reach is bounded by the permissions of the warehouse connection mem0 uses, which is a reason to check that connection scope during remediation.
What to do
- Inventory applications using the mem0 library or service, and identify which of them configure the Databricks vector store backend.
- Upgrade affected deployments to mem0 1.0.8 or later, using the mem0 project release guidance.
- Until upgraded, limit which users and content sources can write memories into Databricks-backed deployments, and review the SQL warehouse permissions granted to the mem0 connection.
- Review Databricks SQL warehouse query history for statements originating from mem0 writes that contain unexpected SQL syntax in memory text, metadata or message name fields.
- Verify the deployed mem0 version after updating, including in agent frameworks that bundle it as a dependency.
Management note
Memory stores sit in the middle of agent applications and quietly accumulate untrusted text from users and retrieved content. If that text is pasted into SQL, every saved memory is a potential injection attempt, so Databricks-backed deployments should patch and check the warehouse query history.