CVE-2026-13511

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-13511

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13511.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-13511

Published

2026-06-28T22:30:11.528Z

Modified

2026-07-15T01:49:10.650141051Z

Severity

1.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

VoltAgent Memory REST API memory.handlers.ts handleGetMemoryConversation improper authorization

Details

A vulnerability was determined in VoltAgent up to 2.1.17. Affected by this issue is the function handleGetMemoryConversation of the file packages/server-core/src/handlers/memory.handlers.ts of the component Memory REST API. Executing a manipulation of the argument conversationId can lead to improper authorization. The attack may be performed from remote. This attack is characterized by high complexity. The exploitation is known to be difficult. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.

Database specific

{
    "cwe_ids": [
        "CWE-266",
        "CWE-285"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13511.json",
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/voltagent/voltagent

Affected ranges

Type

GIT

Repo

https://github.com/voltagent/voltagent

Events

Introduced

2aac2ad3bfa83fed40f6c29f8f5857101b1290e8

Last affected

5be7626632cc7fb8798ec0a06774af6560184e52

Database specific

{
    "extracted_events": [
        {
            "introduced": "2.1.0"
        },
        {
            "last_affected": "2.1.0"
        },
        {
            "introduced": "2.1.1"
        },
        {
            "last_affected": "2.1.1"
        },
        {
            "introduced": "2.1.2"
        },
        {
            "last_affected": "2.1.2"
        },
        {
            "introduced": "2.1.5"
        },
        {
            "last_affected": "2.1.5"
        },
        {
            "introduced": "2.1.3"
        },
        {
            "last_affected": "2.1.3"
        },
        {
            "introduced": "2.1.7"
        },
        {
            "last_affected": "2.1.7"
        },
        {
            "introduced": "2.1.4"
        },
        {
            "last_affected": "2.1.4"
        },
        {
            "introduced": "2.1.6"
        },
        {
            "last_affected": "2.1.6"
        },
        {
            "introduced": "2.1.8"
        },
        {
            "last_affected": "2.1.8"
        },
        {
            "introduced": "2.1.9"
        },
        {
            "last_affected": "2.1.9"
        },
        {
            "introduced": "2.1.10"
        },
        {
            "last_affected": "2.1.10"
        },
        {
            "introduced": "2.1.11"
        },
        {
            "last_affected": "2.1.11"
        },
        {
            "introduced": "2.1.12"
        },
        {
            "last_affected": "2.1.12"
        },
        {
            "introduced": "2.1.13"
        },
        {
            "last_affected": "2.1.13"
        },
        {
            "introduced": "2.1.14"
        },
        {
            "last_affected": "2.1.14"
        },
        {
            "introduced": "2.1.15"
        },
        {
            "last_affected": "2.1.15"
        },
        {
            "introduced": "2.1.16"
        },
        {
            "last_affected": "2.1.16"
        },
        {
            "introduced": "2.1.17"
        },
        {
            "last_affected": "2.1.17"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

2.*

2.1.0

2.1.1

2.1.10

2.1.11

2.1.12

2.1.13

2.1.14

2.1.15

2.1.16

2.1.17

2.1.2

2.1.3

2.1.4

2.1.6

2.1.8

2.1.9

@voltagent/a2a-server@2.*

@voltagent/a2a-server@2.0.3

@voltagent/ag-ui@1.*

@voltagent/ag-ui@1.0.3

@voltagent/ag-ui@1.0.4

@voltagent/ag-ui@1.0.5

@voltagent/ag-ui@1.0.6

@voltagent/ag-ui@1.0.7

@voltagent/cloudflare-d1@2.*

@voltagent/cloudflare-d1@2.1.0

@voltagent/cloudflare-d1@2.1.1

@voltagent/cloudflare-d1@2.1.2

@voltagent/core@2.*

@voltagent/core@2.3.3

@voltagent/core@2.3.4

@voltagent/core@2.3.5

@voltagent/core@2.3.6

@voltagent/core@2.3.7

@voltagent/core@2.3.8

@voltagent/core@2.4.0

@voltagent/core@2.4.1

@voltagent/core@2.4.2

@voltagent/core@2.4.3

@voltagent/core@2.4.4

@voltagent/core@2.5.0

@voltagent/core@2.6.0

@voltagent/core@2.6.1

@voltagent/core@2.6.10

@voltagent/core@2.6.11

@voltagent/core@2.6.12

@voltagent/core@2.6.13

@voltagent/core@2.6.14

@voltagent/core@2.6.2

@voltagent/core@2.6.3

@voltagent/core@2.6.4

@voltagent/core@2.6.5

@voltagent/core@2.6.6

@voltagent/core@2.6.7

@voltagent/core@2.6.8

@voltagent/core@2.7.0

@voltagent/core@2.7.1

@voltagent/core@2.7.2

@voltagent/core@2.7.3

@voltagent/core@2.7.4

@voltagent/core@2.7.5

@voltagent/evals@2.*

@voltagent/evals@2.0.4

@voltagent/langfuse-exporter@2.*

@voltagent/langfuse-exporter@2.0.3

@voltagent/libsql@2.*

@voltagent/libsql@2.1.0

@voltagent/libsql@2.1.1

@voltagent/libsql@2.1.2

@voltagent/postgres@2.*

@voltagent/postgres@2.1.0

@voltagent/postgres@2.1.1

@voltagent/postgres@2.1.2

@voltagent/resumable-streams@2.*

@voltagent/resumable-streams@2.0.2

@voltagent/sandbox-blaxel@2.*

@voltagent/sandbox-blaxel@2.1.0

@voltagent/sandbox-daytona@2.*

@voltagent/sandbox-daytona@2.0.1

@voltagent/sandbox-daytona@2.0.2

@voltagent/sandbox-e2b@2.*

@voltagent/sandbox-e2b@2.0.1

@voltagent/sandbox-e2b@2.0.2

@voltagent/scorers@2.*

@voltagent/scorers@2.1.0

@voltagent/sdk@2.*

@voltagent/sdk@2.0.3

@voltagent/server-core@2.*

@voltagent/server-core@2.1.10

@voltagent/server-core@2.1.11

@voltagent/server-core@2.1.12

@voltagent/server-core@2.1.13

@voltagent/server-core@2.1.14

@voltagent/server-core@2.1.15

@voltagent/server-core@2.1.16

@voltagent/server-core@2.1.17

@voltagent/server-core@2.1.4

@voltagent/server-core@2.1.5

@voltagent/server-core@2.1.6

@voltagent/server-core@2.1.7

@voltagent/server-core@2.1.8

@voltagent/server-core@2.1.9

@voltagent/server-elysia@2.*

@voltagent/server-elysia@2.0.3

@voltagent/server-elysia@2.0.4

@voltagent/server-elysia@2.0.5

@voltagent/server-elysia@2.0.6

@voltagent/server-elysia@2.0.7

@voltagent/server-elysia@2.0.8

@voltagent/server-hono@2.*

@voltagent/server-hono@2.0.10

@voltagent/server-hono@2.0.11

@voltagent/server-hono@2.0.12

@voltagent/server-hono@2.0.13

@voltagent/server-hono@2.0.5

@voltagent/server-hono@2.0.6

@voltagent/server-hono@2.0.7

@voltagent/server-hono@2.0.8

@voltagent/server-hono@2.0.9

@voltagent/serverless-hono@2.*

@voltagent/serverless-hono@2.0.10

@voltagent/serverless-hono@2.0.11

@voltagent/serverless-hono@2.0.7

@voltagent/serverless-hono@2.0.8

@voltagent/serverless-hono@2.0.9

@voltagent/supabase@2.*

@voltagent/supabase@2.1.0

@voltagent/supabase@2.1.1

@voltagent/supabase@2.1.2

@voltagent/supabase@2.1.3

@voltagent/voice@2.*

@voltagent/voice@2.1.0

@voltagent/voltagent-memory@1.*

@voltagent/voltagent-memory@1.0.4

create-voltagent-app@0.*

create-voltagent-app@0.2.19

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13511.json"