CVE-2026-51905

SuperAGI execution configurations lack tenant authorization

TransformerOptimus · SuperAGI agent execution configuration lookup

First documented disclosure · Review checkpoint

Summary

A user can read execution settings belonging to another organization.

Severity and exploitation evidence

Unknown · numeric CVSS score not recorded. Severity source.

Exploitation not established: The researcher describes authorized local cross-organization testing. No reviewed source establishes malicious exploitation or confirmed victims.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The route accepts agent and execution IDs without verifying that the selected resources belong to the authenticated organization.

Conditions required

A multi-organization deployment, an ordinary authenticated account and knowledge or discovery of the target identifiers.

Potential impact

Disclosure of execution configuration, including credentials or sensitive settings if present; the contents depend on the deployment.

Affected versions and configurations

v0.0.14 according to the CNA.

Fix and mitigation status

No issue-specific fixed release is established in the reviewed sources.

Practical next steps

Restrict exposure and isolate organizations until ownership checks are fixed. Validate the selected project, agent and execution against the authenticated organization; verify with two-user regression checks.

Operating lesson

Authorize both the agent and execution record before returning configuration data.

Evidence and limits

The May 27 public issue predates the September 26 gist and October 29 CVE publication. The issue remains open. The published CNA has no CVSS score; numeric severity is not inferred from the impact.

Sources