CVE-2026-51914: Transformeroptimus superagi vulnerability

Published Oct 2, 2026

Updated

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. In affected source snapshots, saveagentastemplate and publishtemplate in superagi/controllers/agenttemplate.py accept caller-supplied agentid or agentexecutionid values and do not verify that the referenced agent or execution belongs to the authenticated user's organization.

Affected Software

1 affected component

transformeroptimus superagi=0.0.14

Event History

Oct 2, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·04:16 PM

Description

Frequently Asked Questions

Who can exploit this issue?

An authenticated user who can invoke the affected agent template controller actions can exploit it by supplying an agent_id or agent_execution_id associated with a different organization. The affected actions do not verify organizational ownership of the referenced object.

Which operations are affected?

The affected source snapshots include the save_agent_as_template and publish_template operations in superagi/controllers/agent_template.py. Both accept caller-supplied agent_id or agent_execution_id values without confirming that the referenced agent or execution belongs to the authenticated user's organization.

How can teams determine whether they are affected?

Review the deployed source for superagi/controllers/agent_template.py and inspect save_agent_as_template and publish_template. The issue is present if these functions accept agent_id or agent_execution_id from the caller without enforcing that the referenced resource belongs to the authenticated user's organization.

CVE-2026-51914: Transformeroptimus superagi vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Which operations are affected?

How can teams determine whether they are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which operations are affected?

How can teams determine whether they are affected?