Loading story…
A high-severity vulnerability tracked as CVE-2026-49948 affects self-hosted Mem0 deployments through version 0.2.8, allowing any authenticated user to modify global settings through the POST /configure endpoint. The flaw stems from missing authorization checks: the server accepts a valid JWT or distributed X-API-Key but does not verify the caller’s role before permitting changes to the instance-wide LLM provider and embedder configuration.
An attacker with low privileges can use the weakness to redirect all LLM and embedding traffic for the instance to an attacker-controlled server, exposing sensitive data and enabling broad integrity compromise across all users and API keys. The malicious configuration is stored in PostgreSQL and survives restarts, making the change persistent until corrected. The issue is classified as CWE-862 and was fixed in commit ae7f406.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
A missing authorization vulnerability affecting Mem0 self-hosted server versions through 0.2.8 was fixed in commit ae7f406. The flaw in the POST /configure endpoint allowed any authenticated user to modify global LLM provider and embedder settings without role validation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity flaw tracked as **CVE-2026-71272** affects `usememos/memos` versions up to and including `0.29.1`, allowing attackers to bypass webhook SSRF protections through a DNS rebinding time-of-check/time-of-use weakness. The issue lies in `safeDialContext()` in `internal/webhook/webhook.go`, where the application validates IP addresses from an initial DNS lookup but later connects using the original hostname, triggering a second DNS resolution at dial time that an attacker-controlled DNS server can change. The vulnerability is classified as **CWE-367** and carries a **CVSS v3.1** vector of `AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N`, indicating low attack complexity and high confidentiality impact. The affected webhook component was designed to block connections to private and reserved IP ranges and supports signed webhook delivery with HMAC-SHA256, but the hostname re-resolution behavior undermines those safeguards when an attacker can control DNS responses for the webhook target.
Aug 6, 2026
LiteLLM fixed two high-severity vulnerabilities in version `1.83.0` that could allow attackers to gain elevated access in AI gateway deployments. **CVE-2026-35029** stems from missing admin authorization on the `/config/update` endpoint, allowing an authenticated low-privilege user to change proxy settings and environment variables. The flaw could be abused to register attacker-controlled Python handlers for remote code execution, read arbitrary server files, and overwrite UI credentials to seize privileged accounts, creating broad confidentiality, integrity, and availability risk. The same release also addressed **CVE-2026-35030**, an authentication bypass affecting LiteLLM deployments that enabled JWT-based authentication. In vulnerable versions, the platform used the first 20 characters of a token as the OIDC userinfo cache key, allowing a crafted token with a matching prefix to collide with a legitimate cached session and inherit that user’s identity and permissions. The issue is not enabled by default, limiting exposure to specific configurations, but together the flaws highlight significant access-control weaknesses in LiteLLM versions prior to `1.83.0`.
Jun 29, 2026
InternLM's **LMDeploy** OpenAI-compatible API server is affected by **CVE-2026-63764**, a critical server-side request forgery flaw that lets unauthenticated attackers reach internal services by abusing image fetching in the `/v1/chat/completions` endpoint. The bug stems from validating only the initial `image_url` host and then following HTTP `302` redirects without re-checking whether subsequent destinations resolve to private or link-local addresses. As a result, an attacker can supply a public URL that redirects the server to targets such as `127.0.0.1` or the cloud metadata address `169.254.169.254`, potentially exposing internal-only applications and cloud IAM credentials. The vulnerability is tracked as **CWE-918** and has been rated **CVSS 9.2**; one affected build identified in public reporting is LMDeploy git version `648df3b`, while broader reporting says versions through **0.14.0** are impacted. A patch was merged to the main branch in **PR #4734**, but public reporting says no tagged release includes the fix yet. The issue was reportedly disclosed after a 36-day period without maintainer response following an initial report by researcher George Chen, increasing urgency for organizations running LMDeploy to review exposure and apply the upstream fix as soon as a release becomes available.
Jul 22, 2026