CVE-2026-13511

Name of the Vulnerable Software and Affected Versions VoltAgent versions prior to 2.1.18

Description An improper authorization issue exists within the Memory REST API component, specifically in the handleGetMemoryConversation() function located in the packages/server-core/src/handlers/memory.handlers.ts file. A remote attacker can manipulate the conversationId argument to bypass authorization controls. This attack is characterized by high complexity and is considered difficult to exploit.

Recommendations As a temporary workaround, restrict access to the handleGetMemoryConversation() function until a patch is available.