CVE-2026-75110

Received Received - Intake

Authentication Bypass in MemOS via Defaultless Secret

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulnCheck

Description

MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled (AUTH_ENABLED=true) but the undocumented, defaultless INTERNAL_SERVICE_SECRET environment variable is unset, the is_internal_request() check in src/memos/api/middleware/auth.py fails open: os.getenv("INTERNAL_SERVICE_SECRET") returns None and a request omitting the X-Internal-Service header also yields None, so the comparison None == None evaluates true. The request is then treated as a trusted internal principal and granted scopes: ["all"]. As a result, an unauthenticated remote attacker can reach the admin API-key management endpoints to mint API keys for any user, enumerate keys, revoke keys, and generate a master key for persistent privileged access, as well as all data endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-08-17

Generated

2026-08-18

AI Q&A

2026-08-18

EPSS Evaluated

N/A

NVD

CVE-2026-75110

EUVD

EUVD-2026-60389

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-697	The product compares two entities in a security-relevant context, but the comparison is incorrect.

Attack-Flow Graph

Executive Summary

This vulnerability affects MemOS, a memory operating system for LLMs and AI agents. When authentication is enabled but the INTERNAL_SERVICE_SECRET environment variable is not set, the system fails to properly validate internal requests. This allows unauthenticated attackers to bypass authentication and access admin API-key management endpoints, granting them privileges to mint API keys, enumerate or revoke existing keys, and generate a master key for persistent access to all data endpoints.

Detection Guidance

Check if AUTH_ENABLED is set to true while INTERNAL_SERVICE_SECRET is unset in MemOS deployments. Inspect logs for unauthenticated requests reaching admin API-key management endpoints or unexpected API key generation activities.

Impact Analysis

If you use MemOS with authentication enabled but without setting INTERNAL_SERVICE_SECRET, an attacker could gain full administrative control over your system. They could create API keys for any user, revoke existing keys, or generate a master key to maintain persistent privileged access. This could lead to unauthorized data access, data theft, or complete system compromise.

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. A breach through this vulnerability could result in unauthorized data exposure, leading to legal penalties, fines, and reputational damage for organizations subject to these regulations.

Mitigation Strategies

Set a strong INTERNAL_SERVICE_SECRET value and ensure it is properly configured. Disable AUTH_ENABLED if not required. Audit and revoke any unauthorized API keys generated due to this issue. Restrict access to admin endpoints.

Hi! I’m here to help you understand CVE-2026-75110. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70