EUVD-2026-91758
GHSA-cwmh-qrfg-2hgm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as any organization user
-
ExploitEnumerate sequential tool_id values
-
ExecutionCall /tools/get or /tools/update/{tool_id}
-
ImpactRead or modify another organization's tool metadata
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a multi-organization (multi-tenant) SuperAGI v0.0.14 deployment and a valid authenticated account in any one organization; the attacker then supplies another tenant's tool_id to /tools/get/{tool_id} or /tools/update/{tool_id}, which fail to verify ownership via the associated toolkit. Limiting factors: authentication is mandatory (not anonymous), impact is confined to tool metadata read/modification rather than full system compromise, and single-organization installations have no other tenant to cross into, so cross-org impact does not arise there. |
| Impact | Signals conflict and point to a materially lower real-world priority than the headline 9.8 suggests. The input CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) scores this as a critical, network, UNauthenticated, full-impact flaw, but the description explicitly states a 'remote authenticated attacker from one organization' - so PR:N contradicts the narrative and should almost certainly be PR:L; verify with the source. The described impact is also narrower than C:H/I:H/A:H: the attacker can read or modify another organization's tool metadata via /tools/get/{tool_id} and /tools/update/{tool_id} - a cross-tenant IDOR / broken object-level authorization issue (CWE-284), with no availability impact described, so A:H appears unjustified. EPSS is low (0.23%, 13th percentile) and there is no CISA KEV listing, indicating no evidence of widespread or active exploitation. A researcher gist is referenced and may contain proof-of-concept detail, but the input provides no explicit POC flag, so public exploit availability is unconfirmed. Net: a genuine multi-tenant authorization bug worth patching in shared SuperAGI deployments, but the 9.8 overstates it - treat as a medium-severity authenticated cross-org data exposure rather than a wormable critical. |
| Exploit ScenarioDerived | In a SuperAGI deployment hosting multiple organizations, an attacker with a valid account in one organization enumerates or guesses tool_id values and calls /tools/get/{tool_id} and /tools/update/{tool_id}, which never check toolkit/organization ownership. They read and tamper with another tenant's tool metadata. A public gist is referenced and may provide proof-of-concept request detail, though POC status is not explicitly confirmed in the input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Cross-organization tool metadata read and modification in SuperAGI v0.0.14 allows an authenticated attacker in one tenant to access or alter another tenant’s tool records through /tools/get/{tool_id} and /tools/update/{tool_id} because the tool controller fails to verify organization ownership via the associated toolkit. The issue only creates cross-tenant impact in multi-organization deployments; single-organization installations have no other tenant to target, and authentication is mandatory in the independent assessment even though the supplied CVE vector lists PR:N. EPSS is low (0.23%, 13th percentile), no public exploit was identified at time of analysis, and the independently assessed CVSS (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) indicates materially lower priority than the headline 9.8.
RemediationAI
No vendor-released patch identified at time of analysis and no fixed version is listed in the provided references, so the primary action is to track the vendor for an update to TransformerOptimus SuperAGI beyond v0.0.14. Until a patched release is available, add server-side authorization in superagi/controllers/tool.py so get_tool and update_tool validate that the supplied tool_id belongs to the authenticated caller’s organization via the associated toolkit; this is the most direct fix but requires code changes and regression testing of tool management. As compensating controls, restrict /tools/get/{tool_id} and /tools/update/{tool_id} to trusted administrators or trusted network paths, or isolate each organization in its own SuperAGI instance so no cross-tenant tool_id can be supplied; these measures can break legitimate multi-tenant tool administration and add operational overhead. Enforce least privilege on SuperAGI accounts and monitor for enumeration of tool_id values across organizations. Advisory references: https://gist.github.com/Ro1ME/f4a6cd6a48b7b904bd7bc4c6d710942f and https://nvd.nist.gov/vuln/detail/CVE-2026-51915.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SuperAGI is an open-source autonomous AI agent framework that organizes resources by organization and toolkit; tools are metadata objects managed through superagi/controllers/tool.py. CVE-2026-51915 is a CWE-284 improper access control / broken object-level authorization issue: get_tool and update_tool accept a caller-supplied tool_id and do not verify that the tool_id belongs to the caller’s organization through the associated toolkit. The supplied NVD-style CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), but the independent assessed vector is AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, reflecting mandatory authentication and limited metadata read/modification impact rather than full system compromise. CPE data is not populated (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*), EUVD-2026-91758 lists affected versions as n/a, and the public reference is a gist plus the NVD advisory. EPSS is 0.23% (13th percentile), and no public exploit code was identified in the provided data.
Know when Superagi gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Authenticated single-org account is required (PR:L, contradicting input PR:N); cross-tenant boundary crossing gives S:C; impact is limited tool-metadata read/modify (C:L/I:L, A:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, get_tool and update_tool in superagi/controllers/tool.py accept a caller-supplied tool_id and fail to verify organization ownership through the associated toolkit. A remote authenticated attacker from one organization can read or modify another organization's tool metadata through /tools/get/{tool_id} and /tools/update/{tool_id}.
Executive ViewAI
SuperAGI v0.0.14 contains a cross-tenant authorization flaw that can let an authenticated user in one organization read or modify another organization's tool metadata in multi-organization deployments. This creates a tenant-isolation and data-integrity risk for customers sharing a SuperAGI instance, while single-organization installations have no other tenant to target. Leadership should prioritize remediation for multi-tenant environments, but note that no public exploit identified at time of analysis and EPSS is low.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting access to the SuperAGI v0.0.14 management and tool endpoints to trusted networks, disabling multi-organization mode if not required, isolating tenants on separate instances, enforcing least-privilege roles, enabling audit logging and monitoring for cross-tenant tool metadata reads or updates, and using a reverse proxy or WAF to block or alert on suspicious /tools/get/{tool_id} and /tools/update/{tool_id} requests.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
A Path Traversal vulnerability exists in the file upload functionality of transformeroptimus/superagi version 0.0.14. Ra
An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. Rated hi
An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. Rated high severity
An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. Rated medium severi
In version 0.0.14 of transformeroptimus/superagi, the API endpoint `/api/users/get/{id}` returns the user's password in
Cross-tenant agent execution manipulation in SuperAGI up to v0.0.14 lets a remote authenticated user in one organization
Remote unauthenticated access to vector database configurations in TransformerOptimus SuperAGI ≤0.0.14 allows attackers
Path traversal in TransformerOptimus SuperAGI versions up to 0.0.14 allows remote unauthenticated attackers to read, wri
Cross-organization agent hijacking in SuperAGI 0.0.14 and earlier lets any authenticated user on a shared multi-tenant i
SuperAGI v0.0.13 was discovered to use a hardcoded key for encryption operations. Rated high severity (CVSS 7.5), this v
TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated remote attackers to bypass authorization controls
Server-side request forgery (SSRF) in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated remote attac
Exploit-DB