CVE-2026-51915

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-02

Last updated on: 2026-10-06

Assigner: MITRE

Description

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, get_tool and update_tool in superagi/controllers/tool.py accept a caller-supplied tool_id and fail to verify organization ownership through the associated toolkit. A remote authenticated attacker from one organization can read or modify another organization's tool metadata through /tools/get/{tool_id} and /tools/update/{tool_id}.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-02

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-02

EPSS Evaluated

2026-10-18

NVD

CVE-2026-51915

EUVD

EUVD-2026-91758

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	n/a	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is an Incorrect Access Control vulnerability in TransformerOptimus SuperAGI v0.0.14. The get_tool and update_tool functions in superagi/controllers/tool.py accept a user-supplied tool_id without verifying if the requester belongs to the same organization as the tool's owner. This allows a remote authenticated attacker from one organization to read or modify another organization's tool metadata via specific endpoints.

Detection Guidance

To detect this vulnerability, inspect the SuperAGI version running on your system. Check if the version is v0.0.14 by reviewing the source code or deployment logs. Verify if the tool.py file contains the vulnerable get_tool and update_tool functions without proper organization ownership checks.

Impact Analysis

If you use SuperAGI v0.0.14, an attacker from another organization could access or alter your tool metadata. This could lead to unauthorized data exposure, tool configuration changes, or disruption of your organization's tools and workflows.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to sensitive data or tools. For GDPR, it may lead to unauthorized data exposure. For HIPAA, it could compromise protected health information if tool metadata includes such data.

Mitigation Strategies

Immediately upgrade SuperAGI to a patched version beyond v0.0.14. If upgrading is not possible, apply access control patches to the tool.py file to enforce organization ownership verification for tool_id requests. Restrict network access to the /tools/get/{tool_id} and /tools/update/{tool_id} endpoints.

Hi! I’m here to help you understand CVE-2026-51915. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70