Superagi
Monthly
Cross-tenant agent execution manipulation in SuperAGI up to v0.0.14 lets a remote authenticated user in one organization create or start execution records for agents owned by another organization through the /agentexecutions/add and /agentexecutions/add_run endpoints. Exploitation requires a multi-tenant deployment hosting more than one organization plus valid credentials in any one tenant, and the attacker must supply a caller-controlled agent_id-likely an enumerable sequential identifier-belonging to the victim organization. The independent assessment lowers the effective vector to authenticated (PR:L) with high integrity and low availability impact rather than unauthenticated 9.8; no public exploit has been identified, EPSS is low at 0.19% (8th percentile), and the main risk is cross-tenant integrity loss in agent execution records.
Cross-organization agent hijacking in SuperAGI 0.0.14 and earlier lets any authenticated user on a shared multi-tenant instance schedule and run agents owned by a different organization through the /api/agentexecutions/schedule endpoint, which accepts an agent_id but never verifies that the referenced agent belongs to the caller's organization. The result is high confidentiality and integrity impact (CVSS 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) with no availability impact, and an attacker only needs a valid low-privileged account plus knowledge or enumeration of a target agent_id - single-tenant or single-organization deployments have no other tenant to victimize and are effectively unaffected. Publicly available exploit code exists (SSVC Exploitation: poc) and no patch is documented, but EPSS is low at 0.16% (4th percentile) and there is no confirmed active exploitation or CISA KEV listing, making this a genuine second-tier risk rather than an emergency.
Cross-organization tool metadata read and modification in SuperAGI v0.0.14 allows an authenticated attacker in one tenant to access or alter another tenant’s tool records through /tools/get/{tool_id} and /tools/update/{tool_id} because the tool controller fails to verify organization ownership via the associated toolkit. The issue only creates cross-tenant impact in multi-organization deployments; single-organization installations have no other tenant to target, and authentication is mandatory in the independent assessment even though the supplied CVE vector lists PR:N. EPSS is low (0.23%, 13th percentile), no public exploit was identified at time of analysis, and the independently assessed CVSS (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) indicates materially lower priority than the headline 9.8.
Broken access control in SuperAGI v0.0.14 and earlier lets any authenticated user in one organization create, schedule, edit, stop, or delete agents belonging to a different organization's project. The controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule, /api/agents/stop_schedule) accept a project_id parameter but never verify that the referenced project belongs to the caller's organization, so an attacker who knows or can enumerate a foreign project_id can tamper with and disrupt another tenant's agents. CISA's SSVC assessment records that publicly available exploit code exists (Exploitation: poc), while the impact is rated partial because there is no confidentiality read primitive; this is a moderate, authenticated IDOR-style flaw that only matters on shared, multi-tenant deployments and is a non-issue on single-org installations.
Server-side request forgery (SSRF) in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated remote attackers to manipulate the WebScraperTool's webpage extraction functions (extract_with_bs4, extract_with_3k, extract_with_lxml) to forge requests to arbitrary servers. The vulnerability has publicly available exploit code and low vendor responsiveness, creating immediate risk for deployments using affected versions.
Path traversal in TransformerOptimus SuperAGI versions up to 0.0.14 allows remote unauthenticated attackers to read, write, or delete arbitrary files via manipulated 'Name' parameter in multipart upload requests. Publicly available exploit code exists (GitHub Gist) demonstrating exploitation. EPSS data unavailable, not currently listed in CISA KEV. CVSS 7.3 reflects network-accessible attack with no authentication barrier, though impact is rated as 'Low' across confidentiality, integrity, and availability - likely indicating file system scope limitations rather than full system compromise.
Authorization bypass in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated remote attackers to access or modify project data without proper authorization checks in the project controller endpoints (get_project, update_project, get_projects_organisation). The vulnerability has publicly available exploit code and affects the project management functionality with limited confidentiality and integrity impact. The vendor did not respond to early disclosure notification.
Authorization bypass in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated attackers to manipulate the agent_id parameter in delete_agent, stop_schedule, and get_schedule_data endpoints, bypassing access controls to perform unauthorized operations on agents and schedules. The vulnerability is remotely exploitable by any authenticated user and publicly available exploit code exists; however, the vendor has not responded to early disclosure attempts.
TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated remote attackers to bypass authorization controls in the Agent Execution Endpoint by manipulating the agent_execution_id parameter in get_agent_execution and update_agent_execution functions. An attacker with valid credentials can access or modify agent execution records they should not have permission to interact with. Publicly available exploit code exists, and the vendor did not respond to early disclosure notification.
Authorization bypass in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated users to modify arbitrary organizations by manipulating the organisation_id parameter in the Organisation Update Endpoint, causing integrity and availability impact. Remote exploitation requires valid credentials and is limited to authenticated users (CVSS PR:L), but publicly available exploit code exists and the vendor has not responded to disclosure.
Authorization bypass in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated remote attackers to modify user accounts by manipulating the user_id parameter in the User Update Endpoint (superagi/controllers/user.py), enabling unauthorized data modification and availability impact. Publicly available exploit code exists; the vendor has not responded to disclosure efforts.
Authorization bypass in TransformerOptimus SuperAGI API Key Management allows authenticated users to delete or edit arbitrary API keys beyond their own permissions, affecting versions up to 0.0.14. The vulnerability exists in the delete_api_key and edit_api_key endpoints and enables authenticated attackers to manipulate other users' credentials remotely with low complexity. Publicly available exploit code exists, and the vendor has not responded to early disclosure.
Remote unauthenticated access to vector database configurations in TransformerOptimus SuperAGI ≤0.0.14 allows attackers to retrieve, modify, or disrupt stored embeddings via the /vector_dbs endpoint. Missing authentication (CWE-306) in the get_vector_db_details function enables unauthorized manipulation of AI agent knowledge bases with CVSS 7.3. Publicly available exploit code exists (Proof-of-Concept published on GitHub Gist), but no active exploitation confirmed via CISA KEV. EPSS data not provided. Vendor unresponsive to early disclosure per VulDB report.
Path traversal vulnerability in SuperAGI up to 0.0.14 allows attackers to read arbitrary files via the download_attachment function in EmailToolKit. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.18%), indicating limited exploitation likelihood.
An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SuperAGI is vulnerable to remote code execution in the latest version. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SuperAGI version v0.0.14 is vulnerable to an unauthenticated Denial of Service (DoS) attack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In version v0.0.14 of transformeroptimus/superagi, there is an improper privilege management vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In version 0.0.14 of transformeroptimus/superagi, the API endpoint `/api/users/get/{id}` returns the user's password in plaintext. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A Path Traversal vulnerability exists in the file upload functionality of transformeroptimus/superagi version 0.0.14. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SuperAGI v0.0.13 was discovered to use a hardcoded key for encryption operations. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-tenant agent execution manipulation in SuperAGI up to v0.0.14 lets a remote authenticated user in one organization create or start execution records for agents owned by another organization through the /agentexecutions/add and /agentexecutions/add_run endpoints. Exploitation requires a multi-tenant deployment hosting more than one organization plus valid credentials in any one tenant, and the attacker must supply a caller-controlled agent_id-likely an enumerable sequential identifier-belonging to the victim organization. The independent assessment lowers the effective vector to authenticated (PR:L) with high integrity and low availability impact rather than unauthenticated 9.8; no public exploit has been identified, EPSS is low at 0.19% (8th percentile), and the main risk is cross-tenant integrity loss in agent execution records.
Cross-organization agent hijacking in SuperAGI 0.0.14 and earlier lets any authenticated user on a shared multi-tenant instance schedule and run agents owned by a different organization through the /api/agentexecutions/schedule endpoint, which accepts an agent_id but never verifies that the referenced agent belongs to the caller's organization. The result is high confidentiality and integrity impact (CVSS 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) with no availability impact, and an attacker only needs a valid low-privileged account plus knowledge or enumeration of a target agent_id - single-tenant or single-organization deployments have no other tenant to victimize and are effectively unaffected. Publicly available exploit code exists (SSVC Exploitation: poc) and no patch is documented, but EPSS is low at 0.16% (4th percentile) and there is no confirmed active exploitation or CISA KEV listing, making this a genuine second-tier risk rather than an emergency.
Cross-organization tool metadata read and modification in SuperAGI v0.0.14 allows an authenticated attacker in one tenant to access or alter another tenant’s tool records through /tools/get/{tool_id} and /tools/update/{tool_id} because the tool controller fails to verify organization ownership via the associated toolkit. The issue only creates cross-tenant impact in multi-organization deployments; single-organization installations have no other tenant to target, and authentication is mandatory in the independent assessment even though the supplied CVE vector lists PR:N. EPSS is low (0.23%, 13th percentile), no public exploit was identified at time of analysis, and the independently assessed CVSS (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) indicates materially lower priority than the headline 9.8.
Broken access control in SuperAGI v0.0.14 and earlier lets any authenticated user in one organization create, schedule, edit, stop, or delete agents belonging to a different organization's project. The controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule, /api/agents/stop_schedule) accept a project_id parameter but never verify that the referenced project belongs to the caller's organization, so an attacker who knows or can enumerate a foreign project_id can tamper with and disrupt another tenant's agents. CISA's SSVC assessment records that publicly available exploit code exists (Exploitation: poc), while the impact is rated partial because there is no confidentiality read primitive; this is a moderate, authenticated IDOR-style flaw that only matters on shared, multi-tenant deployments and is a non-issue on single-org installations.
Server-side request forgery (SSRF) in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated remote attackers to manipulate the WebScraperTool's webpage extraction functions (extract_with_bs4, extract_with_3k, extract_with_lxml) to forge requests to arbitrary servers. The vulnerability has publicly available exploit code and low vendor responsiveness, creating immediate risk for deployments using affected versions.
Path traversal in TransformerOptimus SuperAGI versions up to 0.0.14 allows remote unauthenticated attackers to read, write, or delete arbitrary files via manipulated 'Name' parameter in multipart upload requests. Publicly available exploit code exists (GitHub Gist) demonstrating exploitation. EPSS data unavailable, not currently listed in CISA KEV. CVSS 7.3 reflects network-accessible attack with no authentication barrier, though impact is rated as 'Low' across confidentiality, integrity, and availability - likely indicating file system scope limitations rather than full system compromise.
Authorization bypass in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated remote attackers to access or modify project data without proper authorization checks in the project controller endpoints (get_project, update_project, get_projects_organisation). The vulnerability has publicly available exploit code and affects the project management functionality with limited confidentiality and integrity impact. The vendor did not respond to early disclosure notification.
Authorization bypass in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated attackers to manipulate the agent_id parameter in delete_agent, stop_schedule, and get_schedule_data endpoints, bypassing access controls to perform unauthorized operations on agents and schedules. The vulnerability is remotely exploitable by any authenticated user and publicly available exploit code exists; however, the vendor has not responded to early disclosure attempts.
TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated remote attackers to bypass authorization controls in the Agent Execution Endpoint by manipulating the agent_execution_id parameter in get_agent_execution and update_agent_execution functions. An attacker with valid credentials can access or modify agent execution records they should not have permission to interact with. Publicly available exploit code exists, and the vendor did not respond to early disclosure notification.
Authorization bypass in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated users to modify arbitrary organizations by manipulating the organisation_id parameter in the Organisation Update Endpoint, causing integrity and availability impact. Remote exploitation requires valid credentials and is limited to authenticated users (CVSS PR:L), but publicly available exploit code exists and the vendor has not responded to disclosure.
Authorization bypass in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated remote attackers to modify user accounts by manipulating the user_id parameter in the User Update Endpoint (superagi/controllers/user.py), enabling unauthorized data modification and availability impact. Publicly available exploit code exists; the vendor has not responded to disclosure efforts.
Authorization bypass in TransformerOptimus SuperAGI API Key Management allows authenticated users to delete or edit arbitrary API keys beyond their own permissions, affecting versions up to 0.0.14. The vulnerability exists in the delete_api_key and edit_api_key endpoints and enables authenticated attackers to manipulate other users' credentials remotely with low complexity. Publicly available exploit code exists, and the vendor has not responded to early disclosure.
Remote unauthenticated access to vector database configurations in TransformerOptimus SuperAGI ≤0.0.14 allows attackers to retrieve, modify, or disrupt stored embeddings via the /vector_dbs endpoint. Missing authentication (CWE-306) in the get_vector_db_details function enables unauthorized manipulation of AI agent knowledge bases with CVSS 7.3. Publicly available exploit code exists (Proof-of-Concept published on GitHub Gist), but no active exploitation confirmed via CISA KEV. EPSS data not provided. Vendor unresponsive to early disclosure per VulDB report.
Path traversal vulnerability in SuperAGI up to 0.0.14 allows attackers to read arbitrary files via the download_attachment function in EmailToolKit. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.18%), indicating limited exploitation likelihood.
An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SuperAGI is vulnerable to remote code execution in the latest version. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SuperAGI version v0.0.14 is vulnerable to an unauthenticated Denial of Service (DoS) attack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In version v0.0.14 of transformeroptimus/superagi, there is an improper privilege management vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In version 0.0.14 of transformeroptimus/superagi, the API endpoint `/api/users/get/{id}` returns the user's password in plaintext. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A Path Traversal vulnerability exists in the file upload functionality of transformeroptimus/superagi version 0.0.14. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SuperAGI v0.0.13 was discovered to use a hardcoded key for encryption operations. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.