CVE-2026-51904

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-02

Last updated on: 2026-10-05

Assigner: MITRE

Description

SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, create_agent_execution and create_agent_run in superagi/controllers/agent_execution.py accept a caller-supplied agent_id and fail to verify that the referenced agent belongs to the authenticated user's organization. A remote authenticated attacker from one organization can create or start execution records for agents owned by another organization through /agentexecutions/add or /agentexecutions/add_run.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-02

Last Modified

2026-10-05

Generated

2026-10-19

AI Q&A

2026-10-02

EPSS Evaluated

2026-10-18

NVD

CVE-2026-51904

EUVD

EUVD-2026-91702

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	n/a	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

CVE-2026-51904 is an improper access control vulnerability in SuperAGI versions up to v0.0.14. The issue occurs in the agent execution controller where functions create_agent_execution and create_agent_run do not verify if the provided agent_id belongs to the authenticated user's organization. This allows a remote authenticated attacker from one organization to create or start execution records for agents owned by another organization.

Detection Guidance

To detect this vulnerability, monitor HTTP requests to /agentexecutions/add and /agentexecutions/add_run endpoints for unauthorized agent_id parameters. Check if users can create or start executions for agents outside their organization by inspecting logs for mismatched agent_id and user organization IDs.

Impact Analysis

An attacker could exploit this to run unauthorized agents on behalf of other organizations, potentially accessing sensitive data or performing actions without permission. This could lead to data breaches, resource misuse, or disruption of services for affected organizations.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data, which is a direct violation of GDPR and HIPAA. Organizations may face legal penalties, loss of trust, and reputational damage if such breaches occur due to improper access control.

Mitigation Strategies

Immediately upgrade SuperAGI to a version beyond v0.0.14 where the vulnerability is patched. Review and restrict access to /agentexecutions/add and /agentexecutions/add_run endpoints. Audit existing agent execution records for unauthorized entries.

Hi! I’m here to help you understand CVE-2026-51904. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70