CVE-2026-51903: Security vulnerability

Published Oct 29, 2026

Updated

SuperAGI v0.0.14 contains an improper access control vulnerability in getagentbylatestexecution in superagi/controllers/agentexecution.py. A remote authenticated attacker from one organization can retrieve latest execution and agent metadata for another organization's project through /agentexecutions/get/latest/agent/project/{projectid} by supplying a victim projectid.

Event History

Oct 29, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·06:17 PM

Description

Frequently Asked Questions

Who can exploit this issue?

A remote attacker must be authenticated to SuperAGI and belong to an organization. The attacker can target projects belonging to a different organization.

What access can an attacker obtain?

An attacker can retrieve the latest execution information and agent metadata associated with another organization's project.

What does an attacker need to supply to access another organization's data?

The attacker needs a victim project's project_id and can use it in the /agentexecutions/get/latest/agent/project/{project_id} endpoint.

CVE-2026-51903: Security vulnerability

Event History

Frequently Asked Questions

Who can exploit this issue?

What access can an attacker obtain?

What does an attacker need to supply to access another organization's data?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access can an attacker obtain?

What does an attacker need to supply to access another organization's data?