Executive brief
VoltAgent, an open-source framework for building AI agents, contains a security flaw in its Memory REST API. This vulnerability allows an authenticated user to potentially view or delete conversation history belonging to other users if they know the specific conversation ID. This could lead to the exposure of private chat logs or the unauthorized deletion of agent memory, impacting user privacy and data integrity.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in VoltAgent up to version 2.1.17 within the `handleGetMemoryConversation` function and related handlers in `packages/server-core/src/handlers/memory.handlers.ts`. The Memory REST API fails to validate that the authenticated principal (user) requesting a resource is the actual owner of that resource. By manipulating the `conversationId` parameter, a remote authenticated attacker can read conversation details, list messages, access working memory, or delete conversations belonging to other users. The attack requires network access and valid user credentials, but exploitation is considered high complexity as it requires knowledge of specific target IDs. A fix has been proposed in pull request #1317 but was not yet merged at the time of disclosure.
Affected products
- VoltAgent VoltAgent <= 2.1.17
Timeline
- 2026-05-27: disclosed: Issue and fix PR submitted to GitHub repository
- 2026-06-28: advisory: CVE published to NVD via VulDB