The mem0 1.0.0 server exposes a DELETE /memories endpoint that performs memory reset and table re-creation without enforcing authentication or authorization controls. An attacker can send an unauthenticated DELETE request to trigger a CREATE TABLE SQL command, which may lead to unexpected table re-creation, disruption of the database schema, potential data loss, and denial of service conditions affecting the memory management service. No CVSS score or patch information is currently provided, and the vulnerability is publicly disclosed as of May 12, 2026.

An unauthenticated attacker can cause the mem0 server to reset memory and recreate database tables unexpectedly. This can disrupt the database schema, potentially result in data loss, and cause denial of service to the memory management functionality. There is no indication of remote code execution or privilege escalation beyond these impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the DELETE /memories endpoint through network controls or application-layer protections to prevent unauthenticated access. Monitor for unusual DELETE requests targeting this endpoint.