SuperAGI: Incorrect access control in agent template controller
Summary
SuperAGI v0.0.14 contains an incorrect access control flaw in the agent template controller. The functions save_agent_as_template and publish_template accept caller-supplied agent_id or agent_execution_id values without checking that they belong to the authenticated user's organization. An authenticated user with a low-privilege account in one organization can therefore act on agents and executions of another organization, which affects confidentiality, integrity and availability within the instance.
Affected
- SuperAGI v0.0.14 (per the CVE record)
- Vulnerable functions: save_agent_as_template and publish_template in superagi/controllers/agent_template.py
- Exact NVD version range: Unknown.
Fixed in
- Unknown. No vendor advisory or fix commit was found.
Workaround
- Limit user accounts on the instance to trusted people and keep tenants or projects separated.
- Restrict network access to the agent template endpoints with a firewall or ACL, allowing only trusted administrators.
- Do not expose the instance to the internet; place it behind a VPN or an authenticated reverse proxy.
Exploitation
- CISA SSVC assessment lists exploitation as PoC; automatable: no.
- Not listed in CISA KEV. No confirmed exploitation in the wild found.
Our recommendation
- Inventory all SuperAGI deployments, including developer and test instances, and confirm the version.
- Isolate instances used by multiple teams or organizations, and restrict access to trusted administrators only.
- Do not rely on a fix being available; plan to retire or replace SuperAGI, as the project appears unmaintained.
- Monitor access logs for unusual use of agent template functions.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Discoverer write-up (GitHub Gist) gist.github.com
- OpenCVE: CVE-2026-51914 app.opencve.io
- Vulners NVD: CVE-2026-51914 vulners.com
- HOL Guard: CVE-2026-51914 (CISA ADP Vulnrichment) hol.org
- DataCamp: SuperAGI www.datacamp.com
- Strix: CVE-2026-51914 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:44.
Original description (NVD)
TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. In affected source snapshots, save_agent_as_template and publish_template in superagi/controllers/agent_template.py accept caller-supplied agent_id or agent_execution_id values and do not verify that the referenced agent or execution belongs to the authenticated user's organization.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.