Superagi CVE-2026-6613

Exploitation requires an authenticated user session (PR:L from CVSS vector) - the attacker must have valid login credentials to SuperAGI. The vulnerability exists in the default configuration of the application; no special configuration or feature enablement is needed. The attacker must have network access to the SuperAGI web interface. Critical limiting factor: the attacker cannot exploit this without prior authentication, meaning an initial compromise (credential theft, account creation if registration is public, or insider threat) is a prerequisite. If SuperAGI is deployed with strong authentication controls and credential management, this limits the pool of potential attackers significantly.

While the CVSS score of 5.3 is moderate, the real-world risk is elevated by several factors: (1) exploitation requires authentication (PR:L), reducing the threat surface to users with valid accounts - either legitimate users acting maliciously or attackers who have obtained credentials; (2) publicly available exploit code (POC) lowers the barrier to exploitation; (3) the vulnerability affects core agent management functions (delete, schedule control), creating operational impact; (4) the vendor's non-response to early disclosure suggests no timeline for a fix. Conversely, mitigating factors include: (1) no indication of active exploitation in CISA KEV; (2) CVSS impact scores are low (VC:L/VI:L/VA:L), suggesting limited scope of unauthorized actions per exploitation; (3) this is not unauthenticated RCE. The SSVC framework would rate this as Moderate: exploitation is possible (POC available, PR:L simplifies attack), technical impact is limited to single-user scope, and automatable patching is uncertain given vendor non-response. Priority: organizations running SuperAGI should treat this as important but not critical.

An authenticated user of SuperAGI (either a legitimate user or an attacker with stolen credentials) identifies another user's agent_id through enumeration or log analysis, then crafts HTTP requests to the delete_agent, stop_schedule, or get_schedule_data endpoints with the victim's agent_id parameter. The endpoint processes the request without validating that the requestor owns the agent, allowing unauthorized deletion or control of the victim's agents and schedules. A public exploit (available on GitHub Gist) automates this parameter manipulation for rapid enumeration and exploitation across multiple agents.