CVE-2026-51916: SuperAGI Authentication Bypass Vulnerability

CVE-2026-51916 Overview

CVE-2026-51916 is an incorrect access control vulnerability in TransformerOptimus SuperAGI version 0.0.14. The flaw resides in the delete_user_knowledge function within superagi/controllers/knowledges.py. The POST /knowledges/delete/{knowledge_id} route deletes the specified knowledge object without requiring authentication and without validating organization ownership of the supplied knowledge_id. An unauthenticated remote attacker can delete arbitrary knowledge objects belonging to any organization by sending a crafted HTTP request. The weakness is categorized under CWE-284 (Improper Access Control).

Critical Impact

Unauthenticated remote attackers can permanently delete arbitrary knowledge objects across any organization, resulting in data loss and integrity compromise of the SuperAGI knowledge base.

Affected Products

• TransformerOptimus SuperAGI v0.0.14
• The vulnerable delete_user_knowledge endpoint in superagi/controllers/knowledges.py
• Deployments exposing the SuperAGI API over the network

Discovery Timeline

• 2026-10-02 - CVE-2026-51916 published to the National Vulnerability Database (NVD)
• 2026-10-02 - Last updated in the NVD database

Technical Details for CVE-2026-51916

Vulnerability Analysis

SuperAGI exposes a REST route at POST /knowledges/delete/{knowledge_id} that invokes delete_user_knowledge in superagi/controllers/knowledges.py. The route handler does not enforce authentication, so no session token or API key is required. The handler also fails to verify that the knowledge_id belongs to the caller's organization.

This combination allows any network-reachable actor to issue delete requests against arbitrary knowledge_id values. Because deletion is permanent, successful requests destroy stored knowledge records tied to agent workflows and retrieval-augmented generation pipelines.

The impact is limited to integrity and availability of knowledge objects. Confidentiality is not affected because the endpoint only performs deletions. Attackers can enumerate numeric or sequential knowledge_id values to systematically remove data across tenants in multi-tenant SuperAGI deployments.

Root Cause

The root cause is a missing authentication decorator and missing organization-ownership check on the deletion route. The handler accepts the knowledge_id from the URL path and executes the delete operation without validating caller identity or resource ownership. This is a textbook broken access control pattern under CWE-284.

Attack Vector

Exploitation occurs over the network and requires no privileges or user interaction. An attacker sends an HTTP POST request to /knowledges/delete/{knowledge_id} with any integer identifier. The server processes the request and removes the targeted knowledge object. A public proof-of-concept script is available on GitHub Gist demonstrating the single-request exploitation pattern.

Detection Methods for CVE-2026-51916

Indicators of Compromise

• Unauthenticated POST requests to /knowledges/delete/{knowledge_id} in SuperAGI access logs
• Unexpected deletions of knowledge records with no corresponding authenticated user session
• Sequential enumeration patterns against the /knowledges/delete/ path from a single source IP
• Missing Authorization or session cookie headers on successful 200 responses to the delete endpoint

Detection Strategies

• Alert on any HTTP request to /knowledges/delete/ that lacks an authenticated session identifier
• Correlate database deletion events in the knowledges table with the originating HTTP request and authentication state
• Baseline normal deletion rates per organization and flag deviations that exceed statistical thresholds

Monitoring Recommendations

• Enable verbose request logging on the SuperAGI API gateway including source IP, path, and authentication status
• Forward application logs to a centralized analytics platform for retention and correlation
• Monitor outbound alerts from reverse proxies for anomalous POST traffic to /knowledges/* routes

How to Mitigate CVE-2026-51916

Immediate Actions Required

• Restrict network access to the SuperAGI API using firewall rules or an authenticating reverse proxy
• Place the /knowledges/delete/{knowledge_id} route behind an authenticating gateway that enforces session validation
• Audit the knowledges table for unexpected deletions and restore from backups where necessary
• Rotate API tokens and review organization membership mappings before re-exposing the service

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Review the upstream TransformerOptimus SuperAGI repository for updates addressing the delete_user_knowledge handler. Until an official fix is released, apply the authentication and ownership checks locally in superagi/controllers/knowledges.py and redeploy.

Workarounds

• Add an authentication dependency to the delete_user_knowledge route handler to reject unauthenticated callers
• Enforce an organization-ownership check that verifies the resolved knowledge_id belongs to the authenticated user's organization before deletion
• Deploy a reverse-proxy rule that blocks external access to /knowledges/delete/ and only permits requests from trusted internal services
• Disable the knowledge deletion endpoint entirely if the feature is not required in production

# Example NGINX rule to block external access to the vulnerable route
location ~ ^/knowledges/delete/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://superagi_backend;
}