CVE-2026-51905
Received Received - Intake

Incorrect Access Control in TransformerOptimus SuperAGI

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: MITRE

Description
TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in get_agent_execution_configuration in superagi/controllers/agent_execution_config.py. A remote authenticated attacker from one organization can read another organization's agent execution configuration by supplying the victim agent_id and agent_execution_id to /agent_executions_configs/details/agent_id/{agent_id}/agent_execution_id/{agent_execution_id}. The endpoint lacks an organization ownership check on the selected agent and execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-29
Last Modified
2026-10-29
Generated
2026-10-29
AI Q&A
2026-10-29
EPSS Evaluated
N/A
NVD
CVE-2026-51905
EUVD
EUVD-2026-113343

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a n/a n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-51905 is an Incorrect Access Control vulnerability in TransformerOptimus SuperAGI v0.0.14. It allows a remote authenticated attacker from one organization to read another organization's agent execution configuration by supplying the victim's agent_id and agent_execution_id to a specific endpoint. The endpoint /agent_executions_configs/details/agent_id/{agent_id}/agent_execution_id/{agent_execution_id} lacks organization ownership verification, enabling unauthorized access to sensitive data.

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized access attempts to the endpoint /agent_executions_configs/details/agent_id/{agent_id}/agent_execution_id/{agent_execution_id}. Check logs for requests with mismatched agent_id and agent_execution_id belonging to different organizations. Use tools like Burp Suite to intercept and inspect requests for improper access patterns.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive information such as API keys, credentials, secrets, model configurations, and prompt templates belonging to other organizations. Attackers with valid credentials can exploit this to retrieve confidential data, potentially causing privacy violations and data breaches.

Compliance Impact

This vulnerability can lead to non-compliance with data protection regulations like GDPR and HIPAA by exposing sensitive personal or health information to unauthorized parties. It violates principles of data minimization, access control, and confidentiality required by these standards.

Mitigation Strategies

Immediately update SuperAGI to the latest patched version. Implement strict organization ownership verification for all agent and execution ID requests. Restrict access to the vulnerable endpoint to authorized users only. Review logs for past unauthorized access attempts and audit all exposed configurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-51905. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart