Improper Authorization

Overview @voltagent/server-elysia is an Elysia server implementation for VoltAgent Affected versions of this package are vulnerable to Improper Authorization via the handleGetMemoryConversation function. An attacker can gain unauthorized access to memory conversation data by manipulating the...

Improper Authorization

Overview @voltagent/serverless-hono is a Serverless fetch-based runtime provider for VoltAgent using Hono Affected versions of this package are vulnerable to Improper Authorization via the handleGetMemoryConversation function. An attacker can gain unauthorized access to memory conversation data b...

CVE-2026-13511

CVE-2026-13511 affects VoltAgent up to 2.1.17, specifically the Memory REST API’s memory.handlers.ts function handleGetMemoryConversation. The issue arises from manipulating the argument conversationId, leading to improper authorization. Exploitation is described as possible from remote, with hig...