CVE-2026-6613: TransformerOptimus SuperAGI agent.py get_schedule_data authorization
A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14. Affected is the function deleteagent/stopschedule/getscheduledata of the file superagi/controllers/agent.py. The manipulation of the argument agentid leads to authorization bypass. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6613?
CVE-2026-6613 is classified as a medium severity vulnerability.
How do I fix CVE-2026-6613?
To fix CVE-2026-6613, update TransformerOptimus SuperAGI to version 0.0.15 or higher.
What components are affected by CVE-2026-6613?
CVE-2026-6613 affects the functions delete_agent, stop_schedule, and get_schedule_data in superagi/controllers/agent.py.
What types of attacks can exploit CVE-2026-6613?
CVE-2026-6613 can be exploited to bypass authorization and manipulate agent_id arguments.
Is there a workaround for CVE-2026-6613 while we test the patch?
A possible workaround for CVE-2026-6613 is to restrict access to the affected functions by implementing stricter authorization checks.