Improper Authorization Vulnerability in VoltAgent Memory REST API
CVE-2026-13511

2.3LOW

Key Information:

Vendor: VoltAgent
Status: Voltagent
Vendor: CVE Published:; 28 June 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-13511?

An improper authorization vulnerability exists in the VoltAgent Memory REST API, specifically in the handleGetMemoryConversation function found in packages/server-core/src/handlers/memory.handlers.ts. By manipulating the conversationId argument, an attacker may exploit this issue remotely. Although the complexity of the attack is considered high and the exploitation is known to be challenging, the public disclosure of the exploit raises potential security concerns. A pull request aimed at fixing this vulnerability is currently pending acceptance.

Affected Version(s)

VoltAgent 2.1.0

VoltAgent 2.1.1

VoltAgent 2.1.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-13511 - Proof of Concept