Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
Disclosed vulnerability

CVE-2026-54519: ai-agent-automation memory APIs let any authenticated user read or delete other users' agent memory

AIR-2026-0261 AIR record · 2026-09-ai-agent-automation-cross-user-memory-access
Open in dashboard About
From the supporting source
An authenticated attacker who knows or obtains another user's identifiers can read victim AgentMemory content, including conversation history, agent context, task data, embeddings, and metadataosv.dev
The record
Disclosed
2026-09-17
Vendor
vmdeshpande (open-source project)
Product
AI Agent Automation
Risk domain
Agent behaviour › Unsafe actuation
System type
Generative model
Who acted
AI was the target — missing authorization on agent memory APIs; no model action in the chain
Attack surface
Agent memory
Autonomy level
Assistant
Initial vector
Authenticated idor
Impact type
Unauthorized data access, Data destruction
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI01 – Agent Goal Hijack
MITRE ATLAS
AML.T0048 – External Harms
NIST AI RMF
MEASURE 2.6; MANAGE 1.3
EU AI Act
Annex III §1(c)
ISO/IEC
TR 24028; 24029-1; 23894
AIUC-1
C. Safety
Scope
agent misuse
Mitigation
Require confirmation for destructive actions; Implement dry-run modes; Use layered safety controls.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
AI Agent Automation 0.1.0 through 0.9.0 deployments
Capability abused
agent_memory_readagent_memory_delete
Defense & remediation
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
0.9.1
Taxonomy & references
OWASP ASI02 Tool Misuse and ExploitationCVE-2026-54519missing_ownership_checkidorcross_useragent_memory
Curator notes
OSV record published 2026-09-17: the memory controller authenticates requests but its list, delete and clear functions trust a caller-supplied agent or memory identifier without checking that the record belongs to the requesting user, exposing conversation history, agent context, task data, embeddings and metadata, and allowing deletion. Small open-source project; no exploitation or real-world deployment impact is reported.
Supporting sources
Cite as
Enkrypt AI. "CVE-2026-54519: ai-agent-automation memory APIs let any authenticated user read or delete other users' agent memory". AIR, AIR-2026-0261. https://agentincident.vercel.app/i/AIR-2026-0261/ (accessed 2026-10-19).