AIKIDO-2026-838845
@mastra/server is vulnerable to Missing Authorization
71
High Risk
This Affects:
@mastra/serverTL;DR
The @mastra/server memory API skips the thread ownership check when the server uses authentication without a mapUserToResourceId callback. The resource id then uses a caller supplied value and can be undefined, so storage returns every thread. An authenticated caller can list all threads and read conversation history, messages, and working memory belonging to other resource owners. The fix applies resource scoped access and rejects authenticated requests that cannot be resolved to a resource id.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you configure server authentication without a mapUserToResourceId callback.
Background info
@mastra/server is vulnerable to Missing Authorization in versions 1.1.0 - 1.63.0.
How to fix this
Upgrade the @mastra/server library to the patch version.
Links
Related Issue
Other
github.com/mastra-ai/mastra/blob/%40mastra/server%401.63.1/packages/server/CHANGELOG.mdgithub.com/mastra-ai/mastragithub.com/mastra-ai/mastra/blob/b7e66f0c478a227985e0062794ef058c3714fabf/packages/server/src/server/handlers/utils.ts
vulncheck.com/advisories/mastra-memory-api-thread-ownership-check-is-a-no-op-when-mapusertoresourceid-is-unset
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.