CVE-2026-13511: VoltAgent Memory REST API Authorization Bypass Vulnerability

Technical summary

The vulnerability exists in the handleGetMemoryConversation function within packages/server-core/src/handlers/memory.handlers.ts. The flaw stems from improper authorization checks when processing the conversationId argument. An authenticated user can craft requests with manipulated conversationId values to bypass access controls and retrieve conversation memory data outside their authorization scope. This is a broken access control issue (CWE-266) compounded by inadequate permission validation (CWE-285). The attack vector is network-based, but requires valid credentials and involves high complexity, making exploitation difficult despite public disclosure of the flaw.

Business impact

While the CVSS score is low (3.1), this vulnerability enables authenticated users to view sensitive conversation histories they should not access. In production deployments where VoltAgent handles customer data, support transcripts, or confidential interactions, unauthorized disclosure of these memory records could violate data governance policies and damage customer trust. The impact is limited to confidentiality; attackers cannot modify or delete records. Organizations should prioritize this based on the sensitivity of data stored in VoltAgent conversations and the trust level of their user base.

Affected systems

VoltAgent up to version 2.1.17 is affected. The Memory REST API is the specific attack surface. Organizations should inventory VoltAgent deployments and verify their installed version. The vulnerability does not appear to affect other VoltAgent components or unrelated applications.

Exploitability

Exploitation requires valid authentication credentials and knowledge of target conversationId values. An attacker must be able to guess, enumerate, or obtain conversationId identifiers and then submit modified requests to the Memory REST API. The attack complexity is high, meaning successful exploitation depends on system-specific conditions or non-standard configurations. Public disclosure of the vulnerability means threat actors have access to technical details, but the difficulty barrier remains elevated. This is not a zero-click or unauthenticated attack vector.

Remediation

Upgrade VoltAgent to a patched version once available. The pull request addressing this issue is pending acceptance by the maintainers. Organizations should monitor the official VoltAgent repository and release notes for patch availability. Until a patch is released, implement compensating controls such as restricting API access to trusted networks, implementing strict input validation on conversationId parameters, and monitoring API logs for suspicious access patterns or conversationId enumeration attempts.

Patch guidance

Monitor the VoltAgent GitHub repository and official release channels for version 2.1.18 or later, which is expected to contain the authorization fix. Verify patch availability before upgrading. Once a patched release is published, prioritize deployment in non-production environments first to validate functionality. Test any custom integrations that depend on the Memory REST API to ensure compatibility with the patched version. Given the low CVSS score but public disclosure, a measured two-week patching timeline is reasonable for most organizations unless they have high-sensitivity conversation data.

Detection guidance

Log and monitor Memory REST API calls, especially requests to the handleGetMemoryConversation endpoint. Look for patterns of conversationId enumeration (sequential or unusual ID values) from a single authenticated user or IP address. Anomalous access to conversationIds outside an authenticated user's normal scope—such as an employee accessing customer support conversations they do not manage—warrants investigation. If available, enable API request logging to capture the conversationId values being accessed and compare them against expected usage patterns.

Why prioritize this

Although the CVSS score is low (3.1) and the attack is complex, public disclosure and the ready availability of proof-of-concept details elevate the practical risk. Prioritization should hinge on the sensitivity of conversation data stored in your VoltAgent instance. If conversations contain personally identifiable information, financial details, health data, or trade secrets, escalate priority. If VoltAgent is used only for non-sensitive internal agent logging, this can be addressed within a standard patching cycle. The authentication requirement and high complexity naturally limit blast radius.

Risk score, explained

The CVSS 3.1 score of 3.1 (LOW severity) reflects the requirement for valid authentication (PR:L), high attack complexity (AC:H), and impact limited to confidentiality only (C:L, I:N, A:N). The network vector (AV:N) acknowledges remote exploitability. However, the score does not account for public disclosure or the reputational and compliance consequences of unauthorized data access. Use the CVSS score as one input; factor in your data sensitivity and user trust when determining organizational risk.

Frequently asked questions