EUVD-2026-40008
GHSA-9qqm-g68p-fhhp
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable API with authenticated user requirement (PR:L); high complexity to enumerate victim conversationId; impact limited to reading others' conversation data with no integrity or availability consequence.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in VoltAgent up to 2.1.17. Affected by this issue is the function handleGetMemoryConversation of the file packages/server-core/src/handlers/memory.handlers.ts of the component Memory REST API. Executing a manipulation of the argument conversationId can lead to improper authorization. The attack may be performed from remote. This attack is characterized by high complexity. The exploitation is known to be difficult. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.
AnalysisAI
Improper authorization in VoltAgent's Memory REST API allows an authenticated user to read another user's private conversation history by substituting a victim's conversationId in requests to the handleGetMemoryConversation endpoint. All VoltAgent versions up to and including 2.1.17 are affected; the CVSS 4.0 base score of 2.3 reflects high attack complexity and limited confidentiality impact. No public exploit confirmed active exploitation (CISA KEV absent), but a proof-of-concept is publicly available via GitHub issue #1315, and a fix PR (#1317) remains pending acceptance with no released patched version confirmed at time of analysis.
Technical ContextAI
VoltAgent is an open-source AI agent framework exposing REST API endpoints to manage agent memory and conversations. The vulnerable handler is handleGetMemoryConversation in packages/server-core/src/handlers/memory.handlers.ts, which resolves conversation records by a caller-supplied conversationId without verifying the requesting user's ownership of that conversation. The root cause is CWE-285 (Improper Authorization), manifesting as an Insecure Direct Object Reference (IDOR) pattern. The CPE cpe:2.3:a:n/a:voltagent:*:*:*:*:*:*:*:* covers all affected versions up to 2.1.17. The PR #1317 changeset reveals the authorization gap extends beyond handleGetMemoryConversation to also affect handleDeleteMemoryConversation, handleGetMemoryWorkingMemory, handleListMemoryConversationMessages, and handleListMemoryConversations, indicating a systemic lack of user-ownership enforcement across the entire Memory REST API surface. The fix description - 'Bind memory REST API operations to the authenticated user to prevent cross-user conversation access' - confirms that no per-request ownership check existed before the patch.
RemediationAI
The upstream fix is the GitHub pull request #1317 at https://github.com/VoltAgent/voltagent/pull/1317, which binds Memory REST API operations to the authenticated user to prevent cross-user conversation access; however, this PR was pending acceptance at time of analysis and no patched tagged release version has been independently confirmed - monitor the VoltAgent repository at https://github.com/VoltAgent/voltagent/ for a release incorporating this PR and upgrade immediately when one is available. As a compensating control prior to patch availability, restrict Memory REST API endpoints at the network or API gateway layer so that only trusted or single-user clients can reach them, reducing the blast radius of cross-user access. Disabling the memory REST API endpoints entirely eliminates the vulnerability for deployments that do not require programmatic conversation management, though this removes memory browsing and deletion functionality for all users. Avoid exposing VoltAgent memory endpoints directly to untrusted authenticated users in multi-tenant configurations until a patched release is confirmed.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today