Agent Memory Isolation: What The October 2026 Mem0 And LangGraph Advisories Teach About Multi-Tenant AI Agents

"""Scope keys for agent memory that one tenant cannot forge into another's.

CVE-2026-116575 (Mem0, fixed in 2.0.18, 28 October 2026): the session scope key was built by joining
user_id, agent_id and run_id with unescaped "&" and "=", so a caller who controlled run_id could make
a key equal to another user's. Python 3.14 standard library only. Sample identifiers only.
"""
from __future__ import annotations

import hashlib
import json


def naive_scope(filters: dict[str, str]) -> str:
    """The vulnerable shape: string joining with delimiters the caller can type."""
    return "&".join(f"{k}={filters[k]}" for k in sorted(["user_id", "agent_id", "run_id"]) if filters.get(k))


def safe_scope(tenant: str, filters: dict[str, str]) -> str:
    """Canonical JSON then SHA-256: no delimiter in any value can change the structure."""
    for key in ("user_id", "agent_id", "run_id"):
        value = filters.get(key, "")
        if any(ord(ch) < 32 for ch in value):
            raise ValueError(f"{key} contains control characters")
    body = json.dumps({"tenant": tenant, **{k: filters.get(k, "") for k in ("user_id", "agent_id", "run_id")}},
                      sort_keys=True, separators=(",", ":"))
    return hashlib.sha256(body.encode()).hexdigest()


if __name__ == "__main__":
    victim = {"agent_id": "ops-agent", "run_id": "x", "user_id": "client-0042"}
    # The attacker controls only their own run_id and sends no user_id of their own.
    attacker = {"agent_id": "ops-agent", "run_id": "x&user_id=client-0042"}
    print("naive victim key:  ", naive_scope(victim))
    print("naive attacker key:", naive_scope(attacker))
    print("naive collision:   ", naive_scope(victim) == naive_scope(attacker))
    print("safe collision:    ", safe_scope("firm-a", victim) == safe_scope("firm-a", attacker))
    print("same ids, other tenant:", safe_scope("firm-a", victim) == safe_scope("firm-b", victim))

Python 3.14.4, standard library only. Run once as shown. Sample identifiers only.

"""Namespace checks for a shared agent memory store: reject, never rewrite, and encode identifiers.

CVE-2026-118668 (langgraph-api, fixed in 0.15.0): JavaScript or TypeScript handlers that rewrote the
requested namespace could let a user read outside it. Handlers that rejected instead were not affected.
CVE-2026-118667 (langgraph-sdk, fixed in 0.4.6): IDs interpolated into request paths without encoding.
Python 3.14 standard library only. Sample data only.
"""
from __future__ import annotations

import hashlib
import json
from datetime import datetime, timezone
from urllib.parse import quote

AUDIT: list[dict[str, str]] = []


def audit(**event: str) -> None:
    prev = AUDIT[-1]["hash"] if AUDIT else "0" * 64
    body = {**event, "at": datetime.now(timezone.utc).isoformat(), "prev": prev}
    AUDIT.append({**body, "hash": hashlib.sha256(json.dumps(body, sort_keys=True).encode()).hexdigest()})


def authorise(caller_tenant: str, caller_user: str, namespace: tuple[str, ...]) -> tuple[str, ...]:
    """Allow only the caller's own namespace. Anything else is refused and logged, not quietly rewritten."""
    if namespace[:2] != (caller_tenant, caller_user):
        audit(event="refused", tenant=caller_tenant, user=caller_user, asked="/".join(namespace))
        raise PermissionError(f"{caller_user} may not read {'/'.join(namespace)}")
    audit(event="allowed", tenant=caller_tenant, user=caller_user, asked="/".join(namespace))
    return namespace


def thread_path(thread_id: str) -> str:
    """Encode every path segment, including '/', so '../' cannot move the request elsewhere."""
    return f"/threads/{quote(thread_id, safe='')}/state"


if __name__ == "__main__":
    print(authorise("firm-a", "analyst-7", ("firm-a", "analyst-7", "notes")))
    try:
        authorise("firm-a", "analyst-7", ("firm-a", "analyst-9", "notes"))
    except PermissionError as exc:
        print("refused:", exc)
    print("raw path:    ", "/threads/" + "../assistants/admin" + "/state")
    print("encoded path:", thread_path("../assistants/admin"))
    for e in AUDIT:
        print(f"  {e['event']:<8} {e['asked']:<26} {e['hash'][:12]}")

Python 3.14.4, standard library only. Run once as shown. Sample data only.