MemOS Authentication Bypass via Fail-Open Internal Service Check

Technical Analysis

The is_internal_request() function in auth.py compares the environment variable INTERNAL_SERVICE_SECRET against the value of an incoming X-Internal-Service header; when the environment variable is unset (the undocumented default), os.getenv() returns None, and a request that simply omits the header also yields None, causing None == None to evaluate true. This misconfigured equality check erroneously grants the request scopes: ["all"], the same trust level intended only for internal service-to-service calls. An external attacker with no credentials can therefore reach admin endpoints to create, enumerate, and revoke API keys, and generate a persistent master key, as well as read/write all memory data stored for agents using MemOS. Because MemOS acts as a shared memory backend for potentially many LLM agents, this single flaw crosses agent boundaries, allowing memory poisoning, exfiltration, and persistent backdoor access across the entire deployment.

Affected Systems

MemOS

Detection Signatures

• Requests to admin/API-key endpoints missing X-Internal-Service header combined with successful scope:["all"] grants
• Absence of INTERNAL_SERVICE_SECRET in deployment environment variables
• Log entries showing is_internal_request() returning True for external/untrusted source IPs
• Unexpected creation of new API keys or master keys not tied to known admin sessions
• Spikes in calls to memory data endpoints from unauthenticated or unrecognized clients

Remediation Steps

1. 1

   Set INTERNAL_SERVICE_SECRET

   Ensure INTERNAL_SERVICE_SECRET is always explicitly configured with a strong random value in every deployment; never leave it unset.

2. 2

   Fail closed on missing secret

   Patch is_internal_request() so that if INTERNAL_SERVICE_SECRET is None or unset, the function returns False (deny) rather than comparing None to None.

3. 3

   Reject requests without header

   Explicitly reject requests missing the X-Internal-Service header instead of treating missing values as equal/trusted.

4. 4

   Upgrade MemOS

   Apply the vendor patch or upgrade to a fixed MemOS version once released, and verify the auth middleware logic post-upgrade.

5. 5

   Audit and rotate keys

   Rotate all API keys and master keys, and audit logs for unauthorized key creation or data access since deployment.

6. 6

   Network segmentation

   Restrict access to internal-service endpoints via network policy/firewall so they are unreachable from untrusted networks regardless of application-layer auth.