CVE-2026-51904
Received Received - Intake

Improper Access Control in SuperAGI Agent Execution

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: MITRE

Description
SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, create_agent_execution and create_agent_run in superagi/controllers/agent_execution.py accept a caller-supplied agent_id and fail to verify that the referenced agent belongs to the authenticated user's organization. A remote authenticated attacker from one organization can create or start execution records for agents owned by another organization through /agentexecutions/add or /agentexecutions/add_run.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-51904
EUVD
EUVD-2026-91702

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
superagi superagi to 0.0.14 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-51904 is an improper access control vulnerability in SuperAGI versions up to v0.0.14. The issue occurs in the agent execution controller where functions create_agent_execution and create_agent_run do not verify if the provided agent_id belongs to the authenticated user's organization. This allows a remote authenticated attacker from one organization to create or start execution records for agents owned by another organization.

Impact Analysis

An attacker could exploit this to run unauthorized agents on behalf of other organizations, potentially accessing sensitive data or performing actions without permission. This could lead to data breaches, resource misuse, or disruption of services for affected organizations.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data, which is a direct violation of GDPR and HIPAA. Organizations may face legal penalties, loss of trust, and reputational damage if such breaches occur due to improper access control.

Mitigation Strategies

Immediately upgrade SuperAGI to a version beyond v0.0.14 where the vulnerability is patched. Review and restrict access to /agentexecutions/add and /agentexecutions/add_run endpoints. Audit existing agent execution records for unauthorized entries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-51904. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart