Superagi CVE-2026-6616

An attacker must possess valid authentication credentials to access the SuperAGI application and invoke the WebScraperTool. The vulnerability is triggered specifically when the user supplies a crafted URL to one of the three affected extraction functions: extract_with_bs4, extract_with_3k, or extract_with_lxml in the superagi/helper/webpage_extractor.py component. No special application configuration is required; the vulnerability exists in the default implementation. The attack is limited by: (1) the requirement for authenticated access (PR:L), (2) network egress filtering on the SuperAGI host (if present), and (3) any application-level URL validation that may exist in layers above the vulnerable functions. The vulnerability does NOT require user interaction (UI:N), meaning once an attacker is authenticated, they can directly call the vulnerable functions via API or web interface.

This vulnerability presents moderate-to-high real-world risk despite the CVSS 6.3 score. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) correctly reflects network attack surface with no user interaction required once authenticated, but the authentication requirement (PR:L) significantly reduces the attack surface compared to unauthenticated remote exploits. The presence of publicly available exploit code and the vendor's non-responsive stance elevate practical risk. The EPSS ExploitabilityIndex value in the CVSS vector (E:P) indicates proof-of-concept availability, which aligns with the disclosed Gist exploit. However, without automated scanning signals or CISA KEV confirmation, this appears to be a disclosed but not yet mass-exploited vulnerability. Organizations must prioritize remediation based on whether they expose SuperAGI to untrusted or semi-trusted users who could authenticate and abuse the SSRF to access internal systems (databases, cloud metadata, internal APIs). The limited scope (S:U, no scope escalation) and partial impacts (C:L, I:L, A:L) suggest the attacker cannot directly compromise the SuperAGI host but can use it as a proxy for reconnaissance or data exfiltration.

An authenticated user or insider with access to a SuperAGI instance submits a URL to the WebScraperTool's extraction function pointing to a cloud metadata endpoint (e.g., http://169.254.169.254/latest/meta-data/) or an internal application URL (e.g., http://192.168.1.100:8080/admin/). The vulnerable extraction function processes the request on behalf of the SuperAGI server without URL validation, allowing the attacker to read sensitive metadata, access internal APIs, or enumerate internal network topology. If the application logs or returns extraction results, the attacker gains direct visibility into internal systems.