CVE-2026-54519: AI Agent Automation: Missing ownership checks in memory APIs allow cross-user memory read and deletion
AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, backend/src/controllers/memory.controller.js authenticates requests but listMemories, deleteMemory, and clearAgentMemory use a caller-supplied agentId or memory id without verifying through the related Agent that the record belongs to req.user. An authenticated attacker who knows or obtains another user's identifiers can read victim AgentMemory content, including conversation history, agent context, task data, embeddings, and metadata, delete an individual victim memory, or clear all memory belonging to a victim agent. This breaks tenant isolation and causes unauthorized disclosure and data loss. This issue is fixed in version 0.9.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AI Agent Automationto a version that resolves this vulnerability.Fixed in 0.9.1 - Configuration
Update the memory controller logic so listMemories, deleteMemory, and clearAgentMemory do not trust caller-supplied agentId or memory _id alone; instead verify ownership through the related Agent that the record belongs to req.user.
backend/src/controllers/memory.controller.js ownership checks for AgentMemory APIs (listMemories, deleteMemory, clearAgentMemory) = must verify that requested agentId/memory _id belongs to req.user via the related Agent before returning or deleting memory
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user may exploit it if they know or can obtain another user's agentId or memory _id. No user interaction is required.
What data and operations are exposed?
An attacker can read another user's AgentMemory content, including conversation history, agent context, task data, embeddings, and metadata. They can also delete an individual victim memory or clear all memory associated with a victim agent.
Which deployments are affected?
Versions prior to 0.9.1 are affected where the vulnerable memory API endpoints are available to authenticated users. The issue is fixed in version 0.9.1.
What should be done if immediate upgrading is not possible?
The provided data does not identify a configuration workaround. Restrict access to the affected memory API endpoints to trusted users until version 0.9.1 can be deployed.