← Back to search

CVE-2026-51915

9.8 CRITICALpublic exploit available

Published 2026-10-02 · Updated 2026-10-06

AI risk analysis

Summary
The flaw allows a remote authenticated attacker to read or modify another organization's tool metadata, posing a significant security risk.
Exploitability
Exploitation is relatively straightforward as it requires an authenticated attacker from one organization to target another, making it moderately easy to exploit.
Blast radius
If exploited, the vulnerability could lead to unauthorized access and modification of critical tool metadata across multiple organizations, severely impacting system integrity and confidentiality.
Detection
No reliable host or network indicator is derivable from the published description.
Prioritized remediation
Upgrade to TransformerOptimus SuperAGI v0.0.15 or later.
auth-bypasswebmetadata-modification

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, get_tool and update_tool in superagi/controllers/tool.py accept a caller-supplied tool_id and fail to verify organization ownership through the associated toolkit. A remote authenticated attacker from one organization can read or modify another organization's tool metadata through /tools/get/{tool_id} and /tools/update/{tool_id}.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-284

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.