CVE-2026-51914

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-02

Last updated on: 2026-10-05

Assigner: MITRE

Description

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. In affected source snapshots, save_agent_as_template and publish_template in superagi/controllers/agent_template.py accept caller-supplied agent_id or agent_execution_id values and do not verify that the referenced agent or execution belongs to the authenticated user's organization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-02

Last Modified

2026-10-05

Generated

2026-10-19

AI Q&A

2026-10-02

EPSS Evaluated

2026-10-18

NVD

CVE-2026-51914

EUVD

EUVD-2026-91759

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	n/a	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

TransformerOptimus SuperAGI v0.0.14 has an Incorrect Access Control vulnerability in the agent template controller. The functions save_agent_as_template and publish_template in superagi/controllers/agent_template.py do not verify if the agent_id or agent_execution_id belongs to the authenticated user's organization. This allows unauthorized access to templates from other organizations.

Detection Guidance

To detect this vulnerability, inspect the agent_template.py file in SuperAGI v0.0.14 for the save_agent_as_template and publish_template functions. Check if they validate that agent_id or agent_execution_id belongs to the authenticated user's organization. Look for missing authorization checks in these functions.

Impact Analysis

An attacker could exploit this to access or publish agent templates from other organizations without authorization. This may lead to data leaks, unauthorized modifications, or misuse of agent templates across organizational boundaries.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to sensitive data or agent templates. It may lead to breaches of confidentiality, integrity, or availability, which are critical under GDPR and HIPAA.

Mitigation Strategies

Immediately update SuperAGI to a patched version beyond v0.0.14. Review agent_template.py for the save_agent_as_template and publish_template functions to ensure proper verification of agent_id and agent_execution_id ownership. Restrict access to these functions to authenticated users within their organizations.

Hi! I’m here to help you understand CVE-2026-51914. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70