mem0ai CVE-2026-115324: SQL injection in the Databricks vector store (memory text, metadata or names reach unescaped SQL on the Databricks SQL warehouse). Which mem0 versions are affected and how do I fix it?

What it is: mem0 (the mem0ai Python package) is a memory layer for AI agents. A critical advisory published 2026-10-22 says its Databricks vector store built SQL for inserts and updates by pasting values into the query text. Because memory text, metadata and message names often come from users or from the model itself, crafted content could inject SQL that runs on the configured Databricks SQL warehouse with the credentials mem0 uses. In agent setups this means a prompt or document that ends up stored as memory could trigger it. Am I affected: - mem0ai from 0.1.117 up to (not including) 1.0.8, and - your mem0 config uses the Databricks vector store. Other vector store backends are not covered by this advisory. - Check: pip show mem0ai, and look for a vector_store provider set to databricks in your mem0 config. Fix: 1. Upgrade to mem0ai 1.0.8 or later (pip install -U "mem0ai>=1.0.8"), update lockfiles and redeploy. 2. Give the Databricks credentials mem0 uses the least privilege possible: access only to the memory tables, no admin or broad catalog rights. 3. Until you can upgrade, switch to another vector store or stop storing untrusted content in the Databricks-backed memory. 4. If an exposed agent ran a vulnerable version, review the Databricks SQL warehouse query history for statements against tables other than the memory table, check the memory tables for unexpected changes, and rotate the token mem0 used. Verify: pip show mem0ai reports 1.0.8+, and the warehouse query history shows only the expected memory queries. Sources: https://nvd.nist.gov/vuln/detail/CVE-2026-115324 https://github.com/mem0ai/mem0/pull/4558 https://github.com/advisories/GHSA-7587-9684-52r6