{"id":"CVE-2026-51905","kind":"vulnerability","aliases":["CVE-2026-51905"],"related":[],"title":"SuperAGI: agent execution configs readable across organizations by ID","description":"TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in get_agent_execution_configuration in superagi/controllers/agent_execution_config.py. A remote authenticated attacker from one organization can read another organization's agent execution configuration by supplying the victim agent_id and agent_execution_id to /agent_executions_configs/details/agent_id/{agent_id}/agent_execution_id/{agent_execution_id}. The endpoint lacks an organization ownership check on the selected agent and execution.","summary":"SuperAGI v0.0.14 has an endpoint that returns an agent's execution configuration when given an agent ID and execution ID, without checking that the requester belongs to the owning organization. A logged-in user from one organization can read another organization's agent execution configuration.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SuperAGI","fixed":[],"affected":"<= 0.0.14","ecosystem":"github"}],"ecosystems":[],"tags":["ai-agents","ai-tooling","multi-tenant","self-hosted","superagi"],"not_affected_if":["auth-required","single-organization"],"how_to_check":"Run SuperAGI 0.0.14 or earlier? Check superagi/controllers/agent_execution_config.py (line ~24) for an organization ownership check in get_agent_execution_configuration. Test: as a user in org B, GET /api/agent_executions_configs/details/agent_id/{id}/agent_execution_id/{id} with IDs from org A; a 200 with data means exposed.","fix":"No fixed release known: v0.0.14 is the latest GitHub release and the report (issue #1559) is still open. Until a patch ships, add an organization ownership check to get_agent_execution_configuration in superagi/controllers/agent_execution_config.py, or block the route at the proxy.","status":"open","published_at":"2026-10-29T18:17:32+00:00","first_seen_at":"2026-10-29T18:26:34+00:00","triaged_at":"2026-10-29T18:28:50+00:00","updated_at":"2026-10-29T18:29:55+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-29T18:28:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SuperAGI: agent execution configs readable across organizations by ID","impact":"medium","summary":"SuperAGI v0.0.14 has an endpoint that returns an agent's execution configuration when given an agent ID and execution ID, without checking that the requester belongs to the owning organization. A logged-in user from one organization can read another organization's agent execution configuration.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["superagi","self-hosted","ai-agents"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user reads other organizations' agent execution configurations","analyst_note":"Confirm the fixed version and whether a patch exists; the NVD entry gives no fix status.","how_to_check":"- Check whether your SuperAGI version is `0.0.14`\n- Review `superagi/controllers/agent_execution_config.py` for an organization ownership check in `get_agent_execution_configuration`\n- Test whether `/agent_executions_configs/details/agent_id/{agent_id}/agent_execution_id/{agent_execution_id}` returns data for IDs belonging to another organization","plain_action":"","needs_analyst":true,"not_affected_if":["single-organization","auth-required"],"who_is_affected":"Teams that run SuperAGI with several organizations sharing one instance are exposed, since any authenticated user can request agent and execution IDs from other organizations. Single-organization deployments have less exposure. The sources do not say whether the flaw exists in later versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000715,"input_tokens":4212,"output_tokens":587,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether a patch exists; the NVD entry gives no fix status.","search":"'-2026':11A,14A '-51905':12A,15A '/agent_execution_id':121C '/agent_executions_configs/details/agent_id':118C 'access':83C 'across':6A 'agent':2A,19B,38B,45B,73B,87C,104C,111C,114C,119C,122C,135C 'ai':18B,21B 'ai-ag':17B 'ai-tool':20B 'anoth':70B,101C 'attack':95C 'authent':94C 'belong':55B 'check':51B,131C 'config':4A 'configur':41B,75B,89C,106C 'control':84C 'cve':10A,13A 'endpoint':34B,126C 'execut':3A,40B,48B,74B,88C,105C,115C,123C,137C 'get':86C 'given':43B 'host':28B 'id':9A,46B,49B,112C,116C,120C,124C 'incorrect':82C 'lack':127C 'log':62B 'logged-in':61B 'multi':24B 'multi-ten':23B 'one':66B,97C 'organ':7A,59B,67B,71B,98C,102C,129C 'own':58B 'ownership':130C 'read':69B,100C 'readabl':5A 'remot':93C 'request':54B 'return':36B 'select':134C 'self':27B 'self-host':26B 'superagi':1A,16A,29B,30B,77C 'superagi/controllers/agent_execution_config.py':91C 'suppli':108C 'tenant':25B 'tool':22B 'transformeroptimus':76C 'user':64B 'v0.0.14':31B,78C 'victim':110C 'vulner':80C 'without':50B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted SuperAGI deployments (v0.0.14 and earlier) that serve more than one organization. Any logged-in user can read another organization's agent execution configuration by guessing or learning the agent ID and execution ID. Single-organization installs where every user is trusted can mostly skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T18:17:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-51905","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-51905","severity":null,"published_at":"2026-10-29T18:17:32+00:00","modified_at":"2026-10-29T18:17:32+00:00","first_seen_at":"2026-10-29T18:26:34+00:00","fetched_at":"2026-10-29T18:26:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-51905:1091","url":null,"severity":null,"published_at":"2026-10-29T18:29:55+00:00","modified_at":"2026-10-29T18:29:55+00:00","first_seen_at":"2026-10-29T18:29:55+00:00","fetched_at":"2026-10-29T18:29:55+00:00","note":"Read reporter issue #1559 (open, no maintainer response) and the releases page (latest v0.0.14, no patch). Fix status none is inferred from those pages, not a vendor statement; nothing marked verified. Sibling SuperAGI CVEs (51901, 51904, 51914) are the same class, unpatched."}],"documents":[{"id":18578,"url":"https://github.com/TransformerOptimus/SuperAGI/issues/1559","title":"SuperAGI execution configuration cross-organization disclosure (issue #1559, open)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":18577,"url":"https://github.com/TransformerOptimus/SuperAGI/releases","title":"SuperAGI releases (latest v0.0.14)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}