AI Agent Automation CVE-2026-54519

Requires a valid authenticated account on the target AI Agent Automation instance (PR:L) and knowledge or possession of another tenant's agentId or AgentMemory _id (MongoDB ObjectIds), targeting the listMemories, deleteMemory, or clearAgentMemory endpoints of backend/src/controllers/memory.controller.js in versions prior to 0.9.1. No special non-default configuration, user interaction, or elevated privileges are needed - the missing ownership check exists in the default code path. The practical limiting factor is obtaining valid victim identifiers: ObjectIds are timestamp-based and partially predictable but must still be enumerated or leaked, and the instance must be multi-tenant for cross-user impact to matter.

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High) is well-supported by the description and the fix commit: an authenticated user (PR:L) can, over the network without interaction, read, delete, or wipe another tenant's AgentMemory. The C:H/I:H/A:H triad is honest - read of victim conversation history/context/embeddings (C:H), targeted single-memory deletion (I:H), and full agent-memory clear (A:H) are all demonstrated by the patched functions (listMemories, deleteMemory, clearAgentMemory). Exploitation status: no public exploit identified at time of analysis - there is no KEV listing, no EPSS score provided, and no POC, only the fix commit and GHSA advisory. The one signal that could pull real-world risk below the 8.8 headline is the prerequisite that the attacker must 'know or obtain' another user's agentId or memory _id; these are MongoDB ObjectIds, which are semi-sequential/timestamp-derived rather than cryptographically random, so enumeration is plausible but not guaranteed - a reasonable case exists for AC:H rather than AC:L. Net: a genuine authorization/tenant-isolation break worth patching promptly for any multi-tenant deployment, but the tiny real-world footprint of this project (see prevalence) means it is not a broad, urgent internet-scale threat.

An attacker registers a normal account on a shared AI Agent Automation instance, authenticates, and calls the memory endpoints supplying another tenant's agentId or memory _id (obtained via enumeration of MongoDB ObjectIds or leakage). Because the pre-0.9.1 controller never verifies the record belongs to req.user, the attacker reads the victim's conversation history, context, task data, and embeddings, then deletes or clears the victim agent's memory. No public POC exists, but the fix commit clearly reveals the missing ownership check.