Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | n/a | affected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Fri, 02 Oct 2026 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Improper Access Control Enables Cross-Organization Agent Execution in SuperAGI v0.0.14 | |
| Weaknesses | CWE-284 |
Fri, 02 Oct 2026 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, create_agent_execution and create_agent_run in superagi/controllers/agent_execution.py accept a caller-supplied agent_id and fail to verify that the referenced agent belongs to the authenticated user's organization. A remote authenticated attacker from one organization can create or start execution records for agents owned by another organization through /agentexecutions/add or /agentexecutions/add_run. | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2026-10-02T15:36:44.937Z
Reserved: 2026-06-08T00:00:00.000Z
Link: CVE-2026-51904
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-02T16:16:50.097
Modified: 2026-10-02T16:16:50.097
Link: CVE-2026-51904
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-02T17:00:17Z