CVE-2026-51901

Summary

This vulnerability allows authenticated users to schedule agents from a different organization, bypassing access control checks, potentially leading to unauthorized control of agents.

Exploitability

Exploitation is relatively straightforward as it requires an authenticated user with access to the /api/agentexecutions/schedule endpoint to provide an agent_id belonging to a different organization.

Blast radius

If exploited, this could result in significant unauthorized access and control over agents, potentially leading to data breaches or service disruptions.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to SuperAGI 0.0.15 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.