CVE-2026-13508

mediumCVSS 5.5covered by 1 sourcefirst seen 2026-06-28

A flaw has been found in khoj-ai khoj up to 2.0.0-beta.28. This impacts an unknown function of the file src/khoj/routers/api_chat.py of the component Conversation Sharing Handler. This manipulation of the argument conversation.agent causes incorrect authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.

⚡ Watch CVE-2026-13508

Get an email if CVE-2026-13508 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.

Advisory coverage (1)

mediumCVE-2026-13508: A flaw has been found in khoj-ai khoj up to 2.0.0-beta.28. This impacts an unknown function of…nvd · 2026-06-28

External references

NVD record for CVE-2026-13508

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-13508 status](https://www.csirts.com/badge/CVE-2026-13508)](https://www.csirts.com/cve/CVE-2026-13508)