EUVD-2026-91702
GHSA-63jh-v3gf-wqcq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to multi-tenant SuperAGI instance
-
ExploitEnumerate or guess victim organization agent_id
-
ExecutionPOST foreign agent_id to /agentexecutions/add_run
-
ImpactCreate/start cross-tenant agent execution
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires (1) a multi-tenant SuperAGI deployment (≤ v0.0.14) hosting more than one organization, and (2) valid authenticated credentials in any one organization. The attacker must supply a caller-controlled agent_id referencing an agent owned by a different organization to /agentexecutions/add or /agentexecutions/add_run; knowing or enumerating a victim agent_id (likely sequential integers) is the practical prerequisite. Limiting factors: it is useless on a single-tenant/single-org install, it needs authentication (so not internet-anonymous), and it is confined to execution-record creation and agent run triggering rather than arbitrary code execution. The input CVSS PR:N is inconsistent with this authenticated requirement. |
| Impact | Signals conflict sharply here. The supplied CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H yielding 9.8, but the vector's PR:N (unauthenticated) directly contradicts the description, which states a 'remote authenticated attacker from one organization' - so the 9.8 is almost certainly inflated by an incorrect PR metric; this is a cross-tenant broken-object-level-authorization (BOLA/IDOR) flaw that requires valid credentials in some organization, not an unauthenticated RCE. EPSS is low (0.19%, 8th percentile) and there is no CISA KEV listing, indicating no evidence of widespread or automated exploitation. SSVC-style reading: exploitation status is none/POC-adjacent (a researcher gist reference exists but is not confirmed as working exploit code in the input), automatable is partial (agent_id likely sequential/enumerable), and technical impact is partial-to-total within a victim tenant. Net: this is a genuine multi-tenant authorization defect worth remediating, but it is NOT the near-worst-case 9.8 'unauthenticated full compromise' the headline score implies - real risk is moderate and gated behind authentication and a multi-organization deployment. Verify the true PR level and realistic C/I/A impact with the project before prioritizing as critical. |
| Exploit ScenarioDerived | An attacker signs up for or already holds an account in one organization on a shared/multi-tenant SuperAGI instance (≤ v0.0.14). They send a POST to /agentexecutions/add or /agentexecutions/add_run supplying an agent_id belonging to a different organization, and because the controller never checks org ownership, the server creates or starts an execution for that foreign agent. A referenced public gist may contain proof-of-concept details, but no working exploit is confirmed as weaponized in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Cross-tenant agent execution manipulation in SuperAGI up to v0.0.14 lets a remote authenticated user in one organization create or start execution records for agents owned by another organization through the /agentexecutions/add and /agentexecutions/add_run endpoints. Exploitation requires a multi-tenant deployment hosting more than one organization plus valid credentials in any one tenant, and the attacker must supply a caller-controlled agent_id-likely an enumerable sequential identifier-belonging to the victim organization. The independent assessment lowers the effective vector to authenticated (PR:L) with high integrity and low availability impact rather than unauthenticated 9.8; no public exploit has been identified, EPSS is low at 0.19% (8th percentile), and the main risk is cross-tenant integrity loss in agent execution records.
RemediationAI
No fixed version is identified in the supplied data, so first confirm whether a patched SuperAGI release has been published; do not assume a patch exists solely from the CVE record. If code changes are possible, add server-side organization checks in create_agent_execution and create_agent_run so that the caller-supplied agent_id must resolve to an agent owned by the authenticated user's organization, and enforce org-scoped queries at the model layer. As compensating controls, restrict access to /agentexecutions/add and /agentexecutions/add_run to trusted networks or administrator roles via reverse proxy or application middleware, accepting that this may break normal agent execution workflows for legitimate users. Replace or supplement sequential agent IDs with unpredictable identifiers (for example UUIDs) to make cross-tenant enumeration harder, though this may require schema migration and client updates. Deploy single-organization instances where multi-tenancy is not required, accepting loss of tenant isolation functionality. Enable audit logging and alerting for cross-organization agent_id access attempts and apply least privilege to SuperAGI service accounts; these are detection and containment measures, not substitutes for the missing authorization fix. Advisory references in the supplied data include the GitHub gist https://gist.github.com/Ro1ME/3f712e2a9f643a08c6c825d25fbfe0e0 and the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-51904.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SuperAGI is an AI agent framework whose execution controller exposes endpoints such as /agentexecutions/add and /agentexecutions/add_run. In affected source snapshots up to v0.0.14, the functions create_agent_execution and create_agent_run in superagi/controllers/agent_execution.py accept an agent_id from the request and do not verify that the referenced agent is owned by the authenticated user's organization. This is an improper access control issue (CWE-284) rooted in missing object-level authorization checks across tenant boundaries, not a memory-safety or command-injection flaw. The provided CPE is unpopulated (cpe:2.3:a:n/a:n/a) and EUVD lists no version details, so the vulnerable component is identified from the description and source path rather than authoritative CPE data. The CVE metadata claims CVSS 9.8 with PR:N, but our independent assessment rates it PR:L with C:N/I:H/A:L because valid tenant credentials are required; it does not reach arbitrary code execution in the assessed scenario.
Know when Superagi gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Authenticated cross-tenant attacker so PR:L not PR:N; primary impact is unauthorized creation/start of executions (I:H) with resource-consumption availability (A:L) and no clear data read (C:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, create_agent_execution and create_agent_run in superagi/controllers/agent_execution.py accept a caller-supplied agent_id and fail to verify that the referenced agent belongs to the authenticated user's organization. A remote authenticated attacker from one organization can create or start execution records for agents owned by another organization through /agentexecutions/add or /agentexecutions/add_run.
Executive ViewAI
SuperAGI deployments up to v0.0.14 in multi-tenant configurations expose organizations to cross-tenant manipulation of agent execution records by any authenticated user with credentials in another tenant. This can undermine tenant isolation and integrity of execution data, requiring security and platform teams to treat multi-tenant SuperAGI environments as a trust-boundary risk until a vendor fix is available.
Restrict SuperAGI access to trusted tenants, enforce strict tenant isolation and server-side authorization at the API gateway, protect or disable /agentexecutions/add and /agentexecutions/add_run for untrusted users, replace or mask enumerable sequential agent identifiers, audit execution records for cross-tenant anomalies, and segment multi-tenant deployments until a vendor patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
A Path Traversal vulnerability exists in the file upload functionality of transformeroptimus/superagi version 0.0.14. Ra
An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. Rated hi
An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. Rated high severity
An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. Rated medium severi
In version 0.0.14 of transformeroptimus/superagi, the API endpoint `/api/users/get/{id}` returns the user's password in
Cross-organization tool metadata read and modification in SuperAGI v0.0.14 allows an authenticated attacker in one tenan
Remote unauthenticated access to vector database configurations in TransformerOptimus SuperAGI ≤0.0.14 allows attackers
Path traversal in TransformerOptimus SuperAGI versions up to 0.0.14 allows remote unauthenticated attackers to read, wri
Cross-organization agent hijacking in SuperAGI 0.0.14 and earlier lets any authenticated user on a shared multi-tenant i
SuperAGI v0.0.13 was discovered to use a hardcoded key for encryption operations. Rated high severity (CVSS 7.5), this v
TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated remote attackers to bypass authorization controls
Server-side request forgery (SSRF) in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated remote attac
Exploit-DB