{"apiVersion":"1.0","identifier":"CVE-2026-75110","description":"MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled (AUTH_ENABLED=true) but the undocumented, defaultless INTERNAL_SERVICE_SECRET environment variable is unset, the is_internal_request() check in src/memos/api/middleware/auth.py fails open: os.getenv(-INTERNAL_SERVICE_SECRET-) returns None and a request omitting the X-Internal-Service header also yields None, so the comparison None == None evaluates true. The request is then treated as a trusted internal principal and granted scopes: [-all-]. As a result, an unauthenticated remote attacker can reach the admin API-key management endpoints to mint API keys for any user, enumerate keys, revoke keys, and generate a master key for persistent privileged access, as well as all data endpoints.","publishedAt":"2026-08-17T21:16:50","lastModifiedAt":"2026-08-18T13:17:42","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75110","cvssScore":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00516,"riskScore":1.03,"affectedProduct":"MemOS","affectedVersions":"unknown","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-75110","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-75110","en":"https://www.redsauce.net/en/cves/CVE-2026-75110","fr":"https://www.redsauce.net/fr/cves/CVE-2026-75110","pt":"https://www.redsauce.net/pt/cves/CVE-2026-75110","de":"https://www.redsauce.net/de/cves/CVE-2026-75110","sk":"https://www.redsauce.net/sk/cves/CVE-2026-75110","el":"https://www.redsauce.net/el/cves/CVE-2026-75110"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-75110"}}