SuperAGI: Incorrect access control in tool controller
Summary
SuperAGI v0.0.14 contains an incorrect access control flaw in the tool controller. The get_tool and update_tool functions accept a caller-supplied tool_id without verifying that the tool belongs to the caller's organization. An authenticated user of one organization can therefore read or modify tool metadata of another organization, which may include configuration data for external systems. CVSS 3.1 is rated 9.8 (Critical) by the CNA, while other sources rate it 5.9 (Medium).
Affected
- TransformerOptimus SuperAGI v0.0.14 (per CVE description; exact affected range not confirmed)
- Multi-organization deployments are relevant; single-tenant deployments carry lower risk
- Affected endpoints: /tools/get/{tool_id} and /tools/update/{tool_id}
Fixed in
Unknown. No fixed version has been published by the vendor at the time of research.
Workaround
- No vendor-published workaround available.
- Restrict network access to the SuperAGI API to trusted internal users, e.g. via VPN or an access-controlled reverse proxy.
- Review and reduce user accounts, especially accounts in other organizations, and remove unused ones.
- Review access logs for tool-related requests referencing tool IDs outside the caller's organization.
Exploitation
- Authentication required: a valid user account is needed.
- Known exploited (CISA KEV): No, according to the sources checked.
- Public proof of concept: Unknown. A third-party gist is referenced but its content was not verified.
- Exploitation in the wild: Nothing found in the sources checked.
- CISA SSVC: Exploitation none, automatable yes, technical impact total.
Our recommendation
- Identify all SuperAGI deployments and check whether any run v0.0.14 or earlier.
- Check whether these instances are reachable from the internet and restrict access if they are.
- Monitor the vendor repository and NVD for a fix and apply it as soon as it is available.
- Rotate credentials stored in SuperAGI tool configurations if misuse is suspected.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record gist (Ro1ME) gist.github.com
- VulDB CVE-2026-51915 vuldb.com
- Vulners CVE list entry vulners.com
- Vulners NVD entry vulners.com
- Vulners EUVD entry vulners.com
- GitHub SuperAGI security page github.com
- CISA ADP Vulnrichment summary hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:23.
Original description (NVD)
TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, get_tool and update_tool in superagi/controllers/tool.py accept a caller-supplied tool_id and fail to verify organization ownership through the associated toolkit. A remote authenticated attacker from one organization can read or modify another organization's tool metadata through /tools/get/{tool_id} and /tools/update/{tool_id}.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.