---
id: "CVE-2026-51903"
kind: "vulnerability"
aliases: ["CVE-2026-51903"]
title: "SuperAGI: authenticated users can read other organizations' agent execution metadata"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "SuperAGI", "fixed": [], "affected": "<= 0.0.14", "ecosystem": "github"}]
ecosystems: []
tags: ["ai-agents", "ai-tooling", "multi-tenant", "self-hosted", "superagi"]
not_affected_if: ["auth-required", "no-untrusted-accounts", "single-tenant"]
published_at: "2026-10-29T18:17:32+00:00"
first_seen_at: "2026-10-29T18:26:34+00:00"
updated_at: "2026-10-29T18:29:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-51903", "first_seen_at": "2026-10-29T18:26:34+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T18:29:38+00:00"}]
---

# SuperAGI: authenticated users can read other organizations' agent execution metadata

SuperAGI v0.0.14 lets a logged-in user from one organization fetch the latest execution and agent metadata of another organization's project by supplying that project's ID to an API endpoint. The attacker gets exposure of another tenant's agent activity data, not code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:SuperAGI affected <= 0.0.14 fixed ?

## How to check

- Check whether the SuperAGI version in use is `0.0.14`, for example in the deployed image tag or repository release.
- Review `superagi/controllers/agent_execution.py` for the `get_agent_by_latest_execution` handler and whether it verifies the project belongs to the caller's organization.
- Test whether `/agentexecutions/get/latest/agent/project/{project_id}` returns data for a project ID outside your organization's tenant (unknown if sources give a test procedure).

## Timeline

- 2026-10-29T18:26:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-51903
- 2026-10-29T18:29:38+00:00 analyst — No NVD/vendor page readable and no page found for this CVE id; no fix or patch commit located. Sibling SuperAGI authz CVEs (CVE-2026-6612, 51904) report vendor unresponsive, all up to 0.0.14, so fix left unknown. Nothing verified.

## From the sources

SuperAGI v0.0.14 contains an improper access control vulnerability in get_agent_by_latest_execution in superagi/controllers/agent_execution.py. A remote authenticated attacker from one organization can retrieve latest execution and agent metadata for another organization's project through /agentexecutions/get/latest/agent/project/{project_id} by supplying a victim project_id.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_