SuperAGI: Incorrect access control in agent scheduling endpoint
Summary
SuperAGI up to version 0.0.14 does not check whether an agent belongs to the caller's organization when scheduling it via /api/agentexecutions/schedule. An authenticated user of one organization can therefore schedule existing agents of a different organization. The impact is limited to multi-tenant deployments where several organizations share one SuperAGI instance; a public proof of concept is available.
Affected
- SuperAGI up to and including 0.0.14
- Endpoint: POST /api/agentexecutions/schedule (schedule_existing_agent)
Fixed in
Unknown.
Workaround
- No vendor workaround published.
- Restrict which accounts exist on the instance and remove users from organizations that should not share resources.
- Run separate SuperAGI instances per customer or organization.
- Do not expose the management interface to the internet; limit access via VPN or allow-list.
Exploitation
- Public proof of concept: yes (GitHub issue #1557 and a gist with reproduction steps).
- Not known to be exploited in the wild; not marked as known exploited by CISA.
- Preconditions: network access, a low-privilege authenticated account, no user interaction.
Our recommendation
- Treat as high priority only if SuperAGI is shared between organizations; otherwise assess as low risk.
- Restrict access and isolate tenants until a fixed version is published.
- Review scheduled executions for agents not created by the owning organization.
- Monitor GitHub issue #1557 and the NVD record for a patch, then upgrade promptly.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-51901 GitHub Gist (Ro1ME) gist.github.com
- SuperAGI GitHub Issue #1557 github.com
- VulDB CVE-2026-51901 vuldb.com
- OpenCVE CVE-2026-51901 app.opencve.io
- HOL Guard CISA ADP Vulnrichment CVE-2026-51901 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:58.
Original description (NVD)
SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. The agent execution controller endpoint /api/agentexecutions/schedule allows authenticated users from one organization to schedule existing agents belonging to a different organization without proper authorization checks. The endpoint accepts an agent_id parameter but does not verify that the agent belongs to the authenticated user's organization.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.