CVE-2026-115324: mem0ai Databricks vector store vulnerable to SQL injection

The flaw is in mem0/vector_stores/databricks.py. The insert() method escaped values by hand with _format_sql_value(). The update() method interpolated payload values and the vector id straight into the statement, and used payload keys as column names without any check. The fix pull request also found that delete() put vector_id directly into its WHERE clause.

Memory content is often derived from what users or other systems tell an AI agent. An attacker who can get crafted text, metadata or a message name stored as a memory can break out of the string and run their own SQL. The statement runs with the credentials of the Databricks SQL warehouse that mem0 is configured to use.

That can expose or change any data those credentials reach, and can drop or alter tables. The CVSS vector rates attack complexity as high and needs no privileges or user interaction. The attack path is network-based. The real exposure depends on how much untrusted text your application writes into mem0.

Only deployments that use the Databricks vector store are affected. Other mem0 vector backends are not covered by this advisory.

Affected: mem0ai from 0.1.117 up to but not including 1.0.8, when the Databricks vector store is configured as the provider. Check your installed version:

pip show mem0ai

Then search your mem0 configuration for a vector store provider set to databricks. If you use another provider, this flaw does not apply to you, though upgrading is still sensible.

Upgrade to 1.0.8:

pip install --upgrade "mem0ai>=1.0.8"

Pull request 4558 switches delete(), update() and insert() to parameterized queries through Databricks' StatementParameterListItem. It also rejects payload keys that do not match ^[A-Za-z_][A-Za-z0-9_]*$. Embedding vectors are still inlined as numeric floats because the parameter type does not support arrays. The sources list no workaround. Until you upgrade, limit the permissions of the warehouse credentials mem0 uses.

Review Databricks SQL warehouse query history for statements issued by the mem0 service principal that contain unexpected clauses, extra statements, or table names other than your memory table. Inspect stored memory records for text, metadata or message names that contain SQL fragments such as quotes followed by keywords. Look for failed or malformed INSERT and UPDATE statements, which often precede a working injection. The sources give no specific indicators of compromise.

mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert() and update() string interpolation to execute injected SQL on the configured Databricks SQL warehouse.