CVE-2026-51915
Received Received - Intake

Incorrect Access Control in TransformerOptimus SuperAGI

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: MITRE

Description
TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, get_tool and update_tool in superagi/controllers/tool.py accept a caller-supplied tool_id and fail to verify organization ownership through the associated toolkit. A remote authenticated attacker from one organization can read or modify another organization's tool metadata through /tools/get/{tool_id} and /tools/update/{tool_id}.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-51915
EUVD
EUVD-2026-91758

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Incorrect Access Control vulnerability in TransformerOptimus SuperAGI v0.0.14. The get_tool and update_tool functions in superagi/controllers/tool.py accept a user-supplied tool_id without verifying if the requester belongs to the same organization as the tool's owner. This allows a remote authenticated attacker from one organization to read or modify another organization's tool metadata via specific endpoints.

Detection Guidance

To detect this vulnerability, inspect the SuperAGI version running on your system. Check if the version is v0.0.14 by reviewing the source code or deployment logs. Verify if the tool.py file contains the vulnerable get_tool and update_tool functions without proper organization ownership checks.

Impact Analysis

If you use SuperAGI v0.0.14, an attacker from another organization could access or alter your tool metadata. This could lead to unauthorized data exposure, tool configuration changes, or disruption of your organization's tools and workflows.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to sensitive data or tools. For GDPR, it may lead to unauthorized data exposure. For HIPAA, it could compromise protected health information if tool metadata includes such data.

Mitigation Strategies

Immediately upgrade SuperAGI to a patched version beyond v0.0.14. If upgrading is not possible, apply access control patches to the tool.py file to enforce organization ownership verification for tool_id requests. Restrict network access to the /tools/get/{tool_id} and /tools/update/{tool_id} endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-51915. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart