mem0ai: SQL injection in Databricks vector store lets attackers execute SQL via crafted memory content (CVE-2026-115324)
Severity: critical · Patch status: patched · Since 2026-10-22 · CVE-2026-115324
A SQL injection vulnerability (CVE-2026-115324) was disclosed on 2026-10-22 in mem0ai's Databricks vector store (mem0/vectorstores/databricks.py). Versions 0.1.117 through before 1.0.8 pass attacker-influenced memory text, metadata, or message names into unescaped string interpolation in insert() and update() calls, allowing injection of arbitrary SQL against the configured Databricks SQL warehouse. Any application storing untrusted user content in mem0 memories backed by the Databricks vector store is affected, with high confidentiality, integrity, and availability impact. No in-the-wild exploitation is reported. Fixed in mem0ai 1.0.8 (commit a2ffca3), which escapes/parameterizes the affected queries.
What to do
- Upgrade mem0ai to 1.0.8 or later immediately if you use the Databricks vector store
- If upgrading is delayed, restrict or disable the Databricks vector store path and sanitize/validate memory text, metadata, and message names before storage
- Review Databricks SQL warehouse logs for signs of injected or anomalous queries
- Limit the SQL warehouse credentials used by mem0 to least privilege to contain potential injection impact
- Audit any stored memories for suspicious content that may have been used as an injection vector
Fixed versions
Sources
All live incidents on Threat Watch
