External risk intelligence

mem0 SQL Injection Vulnerability in Databricks Vector Store

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-115324

The vulnerability exists in a library component (mem0) used for data integration with Databricks. While the library may be integrated into internet-facing applications, the flaw is specific to the backend data storage layer. It is plausibly reachable in deployments where user-supplied content is processed and passed to the vector store, but it is not a direct public-facing interface itself.

SQL Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in the mem0 software that impacts how it interacts with Databricks SQL warehouses. The issue arises from improper handling of user-provided data, which could allow an attacker to execute malicious SQL commands on your Databricks environment. This type of attack, known as SQL injection, can lead to unauthorized data access or manipulation if exploited.

Malicious text can trick Databricks into running harmful SQL.
Understand if our Databricks data integration is at risk.
Confirm relevance and exposure to Databricks data stores.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by providing specially crafted input, such as text, metadata, or message names, to the mem0 library. These inputs are not properly escaped and are inserted into SQL queries executed against a Databricks SQL warehouse. This allows the attacker to execute arbitrary SQL commands on the database.

Entry condition: Network access to an application using the mem0 library.
Trigger point: Supplying crafted input to the library.
Resulting risk: Arbitrary SQL execution on the Databricks SQL warehouse.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, attackers could inject SQL by supplying crafted memory text, metadata, or message names that are not properly escaped before being inserted or updated in a Databricks SQL warehouse. This vulnerability affects systems using mem0 for data integration with Databricks.

Databricks SQL warehouse data.
Crafted input may reach unescaped insert/update.
Unauthorized SQL execution on the warehouse.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in the mem0 library's Databricks vector store integration necessitates action from teams managing data pipelines and AI/ML platforms. The first step is to identify all instances of mem0, especially those configured to use Databricks SQL warehouses, and assess their exposure and criticality. Following this, accountable owners must be identified to plan remediation, which may involve vendor coordination or a risk-based maintenance window.

Application and platform owners should act.
Verify mem0 usage with Databricks SQL.
Plan risk-based remediation activities.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is mem0 and how is it used?

Mem0 is a library designed for memory management in AI and machine learning systems. It helps applications maintain context by storing and retrieving user-related information, such as preferences or conversation history, through various vector stores to enhance intelligent data processing.

What does SQL injection mean for CVE-2026-115324?

This vulnerability is classified as CWE-89, or improper neutralization of special elements used in an SQL command. In this context, it means the software fails to sanitize input before using it in database queries. An attacker can supply crafted data that the system mistakenly interprets as valid SQL commands rather than plain text, allowing them to interfere with database operations.

How can an attacker trigger this vulnerability?

An attacker triggers the bug by providing specially crafted text, metadata, or message names to an application using the mem0 library. If these inputs are passed to the affected Databricks vector store component without proper escaping, the system embeds the malicious content directly into SQL queries. The vulnerability is not triggered if the input is never processed by the vulnerable integration or if it does not reach the unescaped insertion point.

Is my Databricks setup at risk?

According to Halo Surface Signal, the risk depends on your application's architecture. While the flaw is in a backend integration component, systems that accept user-provided content and pass it through mem0 to a Databricks SQL warehouse are potentially reachable. Assess whether your application's data flow allows untrusted user input to reach this specific vector store integration.

How do I respond to this vulnerability?

Start by identifying all software instances in your environment that utilize the mem0 library. Determine if any of these are configured to use Databricks SQL warehouses as a backend vector store. If such configurations exist, prioritize them for updates to version 1.0.8 or later to ensure proper input handling, and coordinate with your platform teams to manage the necessary maintenance window.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.