Executive brief
VoltAgent is an AI agent engineering platform used to build and manage conversational AI systems. A flaw in its memory API handlers allows any authenticated user to access, read, modify, or delete conversations and messages belonging to other users by exploiting missing ownership validation. This could expose sensitive conversations, enable data tampering, and disrupt service availability.
Technical details
VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access arbitrary conversations. The vulnerability exists in the memory.handlers.ts file where API endpoints accept caller-supplied conversation identifiers without verifying that the requester owns the conversation. Attackers with valid authentication credentials can read, modify, and delete other users' conversations and messages via a horizontal privilege escalation attack. No patch is indicated as available at the time of publication. The vulnerability is network-reachable and requires only valid authentication (not administrative access).
Affected products
- VoltAgent VoltAgent through 2.1.20
Timeline
- 2026-08-28: disclosed