Medium severity · published Aug 28, 2026
CVE-2026-82273
Mastra Memory API Thread Ownership Check Is a No-op When mapUserToResourceId Is Unset
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and metadata of other resource owners.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
mastra · mastra-ai
through 1.63.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-82273
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-82273
github.com
https://github.com/mastra-ai/mastra
github.com
https://github.com/mastra-ai/mastra/blob/b7e66f0c478a227985e0062794ef058c3714fabf/packages/server/src/server/handlers/utils.ts
github.com
https://github.com/mastra-ai/mastra/issues/18911
www.vulncheck.com
https://www.vulncheck.com/advisories/mastra-memory-api-thread-ownership-check-is-a-no-op-when-mapusertoresourceid-is-unset
More from mastra
6.5
CVE-2025-61685
Mastra Docs MCP Server `@mastra/mcp-docs-server` Leads to Information Exposure