SuperAGI EUVD-2026-91757

Exploitation requires a SuperAGI v0.0.14 instance whose /knowledges/delete/{knowledge_id} endpoint is network-reachable by the attacker; per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed in the affected snapshots. The attacker must supply a valid knowledge_id, so some enumeration or prior knowledge of identifiers is practically needed, though ownership is never checked. The primary limiting factor is deployment exposure: SuperAGI is typically self-hosted and often not internet-facing, so instances bound to localhost or behind an authenticating reverse proxy would not be directly exploitable. Impact is confined to deletion of knowledge objects (integrity), not code execution or data disclosure.

This is a genuine but bounded risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, and the 7.5 score is driven entirely by the integrity impact (I:H) of unauthorized data deletion - confidentiality and availability are rated N. The signals are largely consistent: CISA SSVC marks Exploitation as 'none' (no observed exploitation) but Automatable 'yes' (the delete endpoint can be scripted en masse) with 'partial' Technical Impact, which aligns with an integrity-only, single-object-deletion primitive rather than full system compromise. The CVE is NOT on CISA KEV, and no EPSS score was provided, so there is no data-backed exploitation-probability signal. A gist reference (by 'Ro1ME') is present and is characteristic of a public proof-of-concept, which would raise practical exploitability, but its contents are not verified in the provided data. Net: the technical severity is real for anyone exposing SuperAGI to untrusted networks, but the limited blast radius (deleting knowledge objects, no code execution, no data exfiltration) and SSVC 'Exploitation: none' suggest this is a legitimate-but-moderate priority rather than an emergency, and far below ubiquitous-product critical flaws given SuperAGI's niche footprint.

An attacker who can reach a SuperAGI v0.0.14 instance over the network sends a crafted POST /knowledges/delete/{knowledge_id} request without any credentials, iterating knowledge_id values to delete knowledge objects belonging to other organizations. Because the route enforces neither authentication nor organization ownership, the deletions succeed and are easily automated (SSVC Automatable: yes). A public gist appears to document the technique, lowering the skill required.