Executive brief
Khoj, an AI personal assistant and search tool, contains a security flaw in its conversation sharing feature. When a user shares or forks a chat, the system may incorrectly retain references to private AI agents that should not be accessible to the new user. This could allow an unauthorized person to interact with or gain information about private custom agents they do not own.
Technical details
An improper authorization vulnerability (CWE-863/CWE-285) exists in the Conversation Sharing Handler of Khoj-ai Khoj. The flaw is located in `src/khoj/routers/api_chat.py` and stems from the application failing to properly re-authorize or strip private agent references when a conversation is forked or shared. A remote authenticated attacker can exploit this by manipulating the `conversation.agent` argument, potentially gaining unauthorized access to private or protected agent configurations during chat execution, prompt construction, or model selection. A pull request (#1328) has been submitted to address the issue by enforcing re-authorization of inherited agents before execution.
Affected products
- khoj-ai khoj up to 2.0.0-beta.28
Timeline
- 2026-05-27: patched: Pull request 1328 submitted to fix the issue
- 2026-06-28: disclosed: CVE-2026-13508 published