Skip to content

VertexAiRagMemoryService search_memory does not filter by user_id, causing memory leakage across users #1019

Description

@sqave

Issue description

When using VertexAiRagMemoryService, memory entries retrieved via search_memory are not filtered by user_id, only by session_id. This can result in memory being shared or leaked between different users if session IDs are reused or not globally unique.

In my application, I stored information under a session for user_id = "uid1". Later, when querying from a session with user_id = "uid2" and a different session ID, the same information was still retrieved, suggesting memory is not correctly scoped by user.

Expected behavior:

Memory entries should be filtered, preferably on the server side, by at least the user_id to ensure proper isolation between users.

Possible fix:

Uncomment this line.

if not context.source_display_name.startswith(f"{app_name}.{user_id}."):
     continue

Metadata

Metadata

Assignees

Labels

services[Component] This issue is related to runtime services, e.g. sessions, memory, artifacts, etc

Type

Fields

No fields configured for Bug.

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions