4 min read
News Brief A GitHub advisory published October 28, 2026 says Mem0's session-scope key could be forged with a crafted run_id, letting one tenant, per the advisory, read and overwrite another tenant's recent conversation history. Fixed in mem0ai 2.0.18 (Python) and 3.1.6 (npm).