What’s Vulnerable › Vulnerabilities

CVE-2026-82283: VoltAgent Memory API Handlers Missing Ownership Checks

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-28 · updated 2026-09-23
• Weakness: CWE-639

Description

VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, modify, and delete arbitrary conversations and messages by supplying caller-controlled identifiers to memory endpoints.

Affected products

• voltagent: through 2.1.20

References

• https://github.com/VoltAgent/voltagent
• https://github.com/VoltAgent/voltagent/blob/44b4c8e4998ce56095b2f0e4eaf1a988f5e6d0de/packages/server-core/src/handlers/memory.handlers.ts
• https://github.com/VoltAgent/voltagent/issues/1371
• https://www.vulncheck.com/advisories/voltagent-memory-api-handlers-missing-ownership-checks
• https://github.com/VoltAgent/voltagent/issues/1371

Get alerted when CVE-2026-82283 or the next vulnerability affects your stack