Description

MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled (AUTH_ENABLED=true) but the undocumented, defaultless INTERNAL_SERVICE_SECRET environment variable is unset, the is_internal_request() check in src/memos/api/middleware/auth.py fails open: os.getenv("INTERNAL_SERVICE_SECRET") returns None and a request omitting the X-Internal-Service header also yields None, so the comparison None == None evaluates true. The request is then treated as a trusted internal principal and granted scopes: ["all"]. As a result, an unauthenticated remote attacker can reach the admin API-key management endpoints to mint API keys for any user, enumerate keys, revoke keys, and generate a master key for persistent privileged access, as well as all data endpoints.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-17T21:16:50.043Z",
  "pubdate": "2026-08-17T21:16:50.043Z",
  "executiveSummary": "MemOS contains an authentication bypass vulnerability within its internal request validation mechanism. The vulnerability is classified as an improper authentication flaw affecting deployments where authentication is explicitly enabled via AUTH_ENABLED=true but the INTERNAL_SERVICE_SECRET environment variable is left unset.\nThe risk implication is critical, as unauthenticated remote attackers can fully bypass security controls and obtain administrative privileges across the application. The system incorrectly treats requests lacking proper internal credentials as trusted internal principals granted with unrestricted administrative capabilities.\nAttacker capabilities include complete access to sensitive data endpoints and administrative API-key management interfaces. Exploitation allows malicious actors to enumerate existing API keys, revoke keys, mint arbitrary API keys for any user, and generate a master key for persistent privileged access to the deployment.\nExploitation requirements include a target deployment configured with AUTH_ENABLED=true where the undocumented and defaultless INTERNAL_SERVICE_SECRET environment variable has not been defined by the system administrator.",
  "technicalDetails": "The vulnerability resides in the src/memos/api/middleware/auth.py component, specifically within the is_internal_request() check responsible for validating internal service communications.\nThe root cause stems from insecure handling of environment variables and missing header comparisons. When the INTERNAL_SERVICE_SECRET environment variable is unset, the function execution of os.getenv(\"INTERNAL_SERVICE_SECRET\") returns a None value. Simultaneously, if an incoming HTTP request completely omits the X-Internal-Service header, the extracted header value also evaluates to None.\nThe flaw occurs because the underlying validation logic performs a direct comparison between these two values. Since None == None evaluates to true, the authentication middleware erroneously concludes that the unauthenticated incoming request originates from a trusted internal principal.\nUpon successful evaluation of this flawed comparison, the security context of the request is elevated, and the caller is automatically granted the scopes: [\"all\"]. This completely bypasses standard access control enforcement mechanisms regardless of the AUTH_ENABLED=true configuration status.\nThe attack flow proceeds as follows: First, an unauthenticated remote attacker identifies a target MemOS instance where authentication is enabled. Second, the attacker issues HTTP requests to the target API endpoints while omitting the X-Internal-Service header. Third, the authentication middleware executes the vulnerable is_internal_request() check, which compares the unset environment variable against the missing header, resulting in a type and value match of None. Fourth, the application grants full administrative scopes [\"all\"] to the incoming connection.\nPost-exploitation impact includes full compromise of the affected memory operating system. The attacker can interact with administrative API-key management endpoints to enumerate keys, revoke active keys, mint new administrative or user-specific API keys, and generate a persistent master key, ensuring long-term privileged access to all data endpoints and internal functionalities."
}