SuperAGI: Incorrect access control in agent execution configuration endpoint
Summary
SuperAGI v0.0.14 does not check whether an agent and an agent execution belong to the requesting user's organization in the endpoint that returns agent execution configurations. An authenticated user from one organization can read another organization's configuration by supplying the agent_id and agent_execution_id of the victim. The reporter states that the configuration can contain sensitive data such as API keys and prompts, but this has not been verified. The attack requires a valid account on the same SuperAGI instance.
Affected
- SuperAGI v0.0.14 (per CVE description)
- Other versions: Unknown.
Fixed in
Unknown. No patch or vendor advisory found as of 31 Oct 2026.
Workaround
- No vendor workaround published.
- Limit who holds user accounts and remove unused accounts.
- Keep SuperAGI off the public internet, or place it behind an authenticated VPN or a reverse proxy with an allow-list.
Exploitation
- CISA SSVC: Exploitation 'poc', Automatable 'no'.
- A public PoC is referenced in the reporter's gist; its content has not been verified.
- No evidence of exploitation in the wild; not listed in CISA KEV.
Our recommendation
- Check whether SuperAGI is in use and whether the instance hosts more than one organization or client. Single-organization installations have lower exposure.
- Apply the restrictions above now and monitor GitHub issue #1559 and the NVD record for a fix.
- Review access logs for requests to the agent_executions_configs endpoint from unexpected users.
- Re-check the CVSS score once NVD completes its analysis.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Reporter gist (CVE-2026-51905) gist.github.com
- SuperAGI GitHub issue #1559 github.com
- Strix CVE-2026-51905 details www.strix.ai
- VulDB entry 428711 vuldb.com
- Vulners PT-2026-132778 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:00.
Original description (NVD)
TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in get_agent_execution_configuration in superagi/controllers/agent_execution_config.py. A remote authenticated attacker from one organization can read another organization's agent execution configuration by supplying the victim agent_id and agent_execution_id to /agent_executions_configs/details/agent_id/{agent_id}/agent_execution_id/{agent_execution_id}. The endpoint lacks an organization ownership check on the selected agent and execution.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.