---
id: CVE-2026-54519
title: >-
  AI Agent Automation is a modular AI agent workflow automation platform with
  schedulers, tools, and observability
summary: >-
  AI Agent Automation is a modular AI agent workflow automation platform with
  schedulers, tools, and observability. Prior to 0.9.1,
  backend/src/controllers/memory.controller.js authenticates requests but
  listMemories, deleteMemory, and cle…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-862
vendor: vmDeshpande
product: ai-agent-automation
affected:
  - ai-agent-automation < 0.9.1
published: '2026-09-17'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T02:16:32.073'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54519'
references:
  - url: >-
      https://github.com/vmDeshpande/ai-agent-automation/commit/96b31c216f6f670e64584f3623c07ac54461e703
    label: security-advisories@github.com
  - url: 'https://github.com/vmDeshpande/ai-agent-automation/releases/tag/v0.9.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/vmDeshpande/ai-agent-automation/security/advisories/GHSA-qv97-83w4-ff86
    label: security-advisories@github.com
  - url: >-
      https://github.com/vmDeshpande/ai-agent-automation/security/advisories/GHSA-qv97-83w4-ff86
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-22T01:56:15.696026Z'
epss: 0.00354
epssPercentile: 0.29187
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/chaitanyagarware/CVE-2026-54519'
  checkedAt: '2026-09-24T07:53:07.166Z'
ingestedAt: '2026-09-17T22:30:21.400Z'
---

## Overview

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, backend/src/controllers/memory.controller.js authenticates requests but listMemories, deleteMemory, and clearAgentMemory use a caller-supplied agentId or memory _id without verifying through the related Agent that the record belongs to req.user. An authenticated attacker who knows or obtains another user's identifiers can read victim AgentMemory content, including conversation history, agent context, task data, embeddings, and metadata, delete an individual victim memory, or clear all memory belonging to a victim agent. This breaks tenant isolation and causes unauthorized disclosure and data loss. This issue is fixed in version 0.9.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.