CVE-2026-13508: Khoj-AI Auth Bypass Vulnerability

CVE-2026-13508 Overview

CVE-2026-13508 is an incorrect authorization vulnerability [CWE-285] in the khoj-ai khoj project through version 2.0.0-beta.28. The flaw resides in the Conversation Sharing Handler implemented in src/khoj/routers/api_chat.py. An authenticated remote attacker can manipulate the conversation.agent argument to bypass authorization checks associated with shared conversations. Public exploit code exists, and a pull request proposing a fix is pending acceptance upstream.

Critical Impact
Authenticated remote attackers can abuse the conversation sharing endpoint to access or modify conversation agent data outside their authorization scope, leading to limited confidentiality, integrity, and availability impact.

Affected Products

khoj-ai khoj up to and including 2.0.0-beta.28
Component: Conversation Sharing Handler (src/khoj/routers/api_chat.py)
Deployments exposing the khoj chat API to remote users

Discovery Timeline

2026-06-28 - CVE-2026-13508 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-13508

Vulnerability Analysis

The vulnerability is an incorrect authorization defect [CWE-285] in khoj's chat API layer. The api_chat.py router exposes functionality that handles shared conversations. When processing requests that reference a conversation, the server accepts the conversation.agent argument supplied by the caller without adequately verifying that the requesting user is authorized to act on the referenced agent or conversation. This trust-in-client pattern permits authorized users of the platform to escape the intended object-level access boundary.

Because exploitation only requires network access and low privileges (a valid account) plus limited user interaction, the flaw is practical against internet-exposed khoj deployments. Public exploit details have been referenced through VulDB, increasing the likelihood of opportunistic abuse. Consult the khoj issue tracker and the pending pull request for full technical context.

Root Cause

The root cause is missing or incomplete server-side authorization validation on the conversation.agent parameter within the Conversation Sharing Handler. The handler consumes the client-supplied agent reference and proceeds without confirming ownership or explicit share permissions between the requester and the target conversation or agent record.

Attack Vector

An authenticated attacker sends a crafted HTTP request to the chat API endpoint served by api_chat.py. By substituting the conversation.agent value with an identifier belonging to another user or agent context, the attacker triggers the handler to operate on unauthorized data. The attack vector is network-based and requires user interaction consistent with normal chat workflows.

No verified proof-of-concept code has been reproduced in this article. Refer to the VulDB entry for CVE-2026-13508 for the disclosed exploitation details.

Detection Methods for CVE-2026-13508

Indicators of Compromise

Requests to khoj chat API routes defined in src/khoj/routers/api_chat.py where the conversation.agent value does not map to an agent owned by the authenticated user.
Unexpected access patterns to shared conversation endpoints from accounts that historically do not use sharing features.
Rapid enumeration of agent or conversation identifiers within short time windows from a single session or token.

Detection Strategies

Enable application-level audit logging around the Conversation Sharing Handler and correlate the authenticated user ID with the conversation.agent owner ID.
Deploy a reverse proxy or WAF rule that inspects chat API payloads and flags requests whose supplied agent identifier does not appear in the caller's prior session history.
Add automated tests or runtime assertions verifying that authorization checks execute before any operation reads or mutates conversation state.

Monitoring Recommendations

Ingest khoj application logs into a centralized analytics pipeline and alert on repeated authorization anomalies against api_chat endpoints.
Monitor outbound responses for size or structure changes that indicate cross-tenant data leakage from the chat API.
Track khoj release notes and the khoj GitHub repository for the merge of the proposed fix.

How to Mitigate CVE-2026-13508

Immediate Actions Required

Restrict network exposure of khoj instances to trusted users only, using VPN, SSO gateways, or IP allow lists until a patched release is available.
Disable or gate the conversation sharing feature at the reverse proxy layer if it is not required in your deployment.
Rotate API tokens and session credentials for any accounts suspected of abusing the sharing endpoint.
Review application logs since deployment for anomalous conversation.agent values crossing account boundaries.

Patch Information

At the time of publication, no fixed release of khoj is available. The upstream fix is proposed in the pending pull request #1328 and tracked in issue #1327. Operators should monitor the khoj repository and upgrade to the first release that merges these changes.

Workarounds

Apply the changes from the pending pull request as a local patch after independent review, then rebuild the khoj container or Python package.
Front the khoj service with an authenticating reverse proxy that enforces per-user identifier scoping on chat API requests.
Temporarily remove or comment out the sharing route in src/khoj/routers/api_chat.py if the feature is not required in production.

bash

# Configuration example: restrict khoj chat API at reverse proxy (nginx)
location /api/chat/ {
    auth_request /_auth;
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://khoj_backend;
}