CVE-2026-51915: Transformeroptimus superagi vulnerability

Published Oct 2, 2026

Updated

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, gettool and updatetool in superagi/controllers/tool.py accept a caller-supplied toolid and fail to verify organization ownership through the associated toolkit. A remote authenticated attacker from one organization can read or modify another organization's tool metadata through /tools/get/{toolid} and /tools/update/{toolid}.

Affected Software

1 affected component

transformeroptimus superagi=0.0.14

Event History

Oct 2, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·04:16 PM

Description

Frequently Asked Questions

Who is exposed to this issue?

Organizations using affected TransformerOptimus SuperAGI v0.0.14 source snapshots are exposed where authenticated users from different organizations can access the tool controller endpoints.

What does an attacker need to exploit it?

The attacker must be remotely authenticated as a user in one organization and know or supply a tool_id belonging to another organization. The affected endpoints are /tools/get/{tool_id} and /tools/update/{tool_id}.

What can an attacker do through the vulnerable endpoints?

An attacker can read another organization's tool metadata through get_tool or modify that metadata through update_tool. The missing check is organization ownership via the tool's associated toolkit.

CVE-2026-51915: Transformeroptimus superagi vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What can an attacker do through the vulnerable endpoints?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What can an attacker do through the vulnerable endpoints?