Skip to content
OpenAdvisories

Vendor

mastra-ai

2 known vulnerabilities.

Products

mastra 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-82273

    Mastra Memory API Thread Ownership Check Is a No-op When mapUserToResourceId Is Unset

    Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads …

    mastra-ai mastra
  • Medium 6.5
    CVE-2025-61685

    Mastra Docs MCP Server `@mastra/mcp-docs-server` Leads to Information Exposure

    Mastra is a Typescript framework for building AI agents and assistants. Versions 0.13.8 through 0.13.20-alpha.0 are vulnerable to a Directory Traversal attack that results in the disclosure of directory listings. The code contains a security check to prevent …

    mastra-ai mastra @mastra/mcp-docs-server npm