An authentication bypass in MemTensor MemOS versions 0 through 2.0.30 allows unauthenticated remote attackers to gain full administrative control over the platform.

This vulnerability occurs because the internal request validation logic fails open when the INTERNAL_SERVICE_SECRET environment variable is unset, resulting in an incorrect comparison. This allows an unauthenticated remote attacker to bypass authentication mechanisms and interact with administrative API endpoints.

The potential impact of this vulnerability is severe, as it permits full administrative access to the platform without authentication. An attacker could manage API keys, exfiltrate sensitive data, or establish persistent privileged access, which aligns with the critical CVSS score of 9.8. This represents a total loss of confidentiality, integrity, and availability for the affected MemOS deployment.

Immediate Action: Upgrade to the latest version of MemTensor MemOS to ensure the authentication middleware logic is correctly implemented.

Proactive Monitoring: Review system logs for unauthorized access to administrative API-key management endpoints and monitor for unexpected generation or revocation of API keys.

Compensating Controls: Ensure the INTERNAL_SERVICE_SECRET environment variable is explicitly configured and set to a strong, unique value in all production deployments to prevent the logic from falling into the vulnerable state.

Public Exploit Available: exploit_available (unknown)

Given the critical nature of this authentication bypass, administrators must prioritize patching MemOS immediately. The ease of exploitation and the level of access granted make this a high-priority target for threat actors, and immediate mitigation is required to prevent unauthorized administrative control.