CVE-2026-75110

The record

MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled (AUTH_ENABLED=true) but the undocumented, defaultless INTERNAL_SERVICE_SECRET environment variable is unset, the is_internal_request() check in src/memos/api/middleware/auth.py fails open: os.getenv("INTERNAL_SERVICE_SECRET") returns None and a request omitting the X-Internal-Service header also yields None, so the comparison None == None evaluates true. The request is then treated as a trusted internal principal and granted scopes: ["all"]. As a result, an unauthenticated remote attacker can reach the admin API-key management endpoints to mint API keys for any user, enumerate keys, revoke keys, and generate a master key for persistent privileged access, as well as all data endpoints.

Affected packages

Related vulnerabilities

• CVE-2026-101913 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in… CWE-697
• CVE-2026-101912 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in… CWE-697
• CVE-2026-90711 proxy-addr is a Node.js module that determines a request's client address behind trusted… CWE-697
• CVE-2026-64836 ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control… CWE-697
• CVE-2026-56101 OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the… CWE-697
• CVE-2026-73309 XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token… CWE-697
• CVE-2026-80227 Incorrect Comparison vulnerability in ash-project ash_sql allows a user to pad a string… CWE-697
• CVE-2026-18664 When ranges are used for access control (i.e. CWE-697