Superagi CVE-2026-6612

The attacker must possess valid authentication credentials for SuperAGI (valid username and password or API token). The Agent Execution Endpoint must be accessible over the network (AV:N confirmed in CVSS vector). No special configuration or non-default settings are required; the vulnerability exists in the default endpoint behavior. The vulnerability is exploitable if SuperAGI is deployed in a multi-user environment where different users have access to the system and their agent execution records should be isolated from one another. Exploitation does not require user interaction or special privileges beyond standard authenticated access. Organizations deploying SuperAGI in single-user, fully isolated, or air-gapped environments face lower practical risk, though the technical vulnerability remains present.

This vulnerability presents moderate real-world risk despite the moderate CVSS score of 5.3. The CVSS vector confirms authentication is required (PR:L), limiting exposure to users with valid accounts or those who can obtain credentials. Attack Vector is Network (AV:N) and Complexity is Low (AC:L), indicating straightforward exploitation once authenticated. The Exploitability is set to Probable (E:P), and the Impact scope shows Low confidentiality, integrity, and availability impacts (VC:L/VI:L/VA:L), suggesting attackers can read and modify agent execution data but cannot achieve complete system compromise. The presence of publicly available exploit code (GitHub Gist reference) confirms the vulnerability is trivial to exploit. However, the requiring authentication significantly reduces real-world risk compared to an unauthenticated variant. Organizations running SuperAGI in multi-tenant or sensitive environments where agent execution records contain confidential data should prioritize remediation; those using SuperAGI as a single-user development tool face lower risk. The vendor's lack of response to disclosure is concerning for long-term security posture.

An authenticated user with a valid SuperAGI account obtains the application's base URL and identifies another user's agent execution by enumerating sequential agent_execution_id values. The attacker crafts a GET or POST request to the Agent Execution Endpoint, replacing the ID parameter with a target ID they do not own. Due to insufficient authorization validation, the endpoint returns sensitive execution records or allows the attacker to modify execution parameters (e.g., changing workflow instructions, stealing logs, or disrupting agent operations). The publicly available GitHub Gist exploit automates this enumeration and data extraction.