TransformerOptimus SuperAGI 0.0.14 Agent Execution Configuration agent_execution_config.py get_agent_execution_configuration agent_id/agent_execution_id access control

Summaryinfo

A vulnerability has been found in TransformerOptimus SuperAGI 0.0.14 and classified as problematic. This affects the function get_agent_execution_configuration of the file superagi/controllers/agent_execution_config.py of the component Agent Execution Configuration. The manipulation of the argument agent_id/agent_execution_id leads to access control. This vulnerability is documented as CVE-2026-51905. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in TransformerOptimus SuperAGI 0.0.14 and classified as problematic. This issue affects the function get_agent_execution_configuration of the file superagi/controllers/agent_execution_config.py of the component Agent Execution Configuration. The manipulation of the argument agent_id/agent_execution_id with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality. The summary by CVE is:

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in get_agent_execution_configuration in superagi/controllers/agent_execution_config.py. A remote authenticated attacker from one organization can read another organization's agent execution configuration by supplying the victim agent_id and agent_execution_id to /agent_executions_configs/details/agent_id/{agent_id}/agent_execution_id/{agent_execution_id}. The endpoint lacks an organization ownership check on the selected agent and execution.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-51905 since 06/08/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/29/2026). The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• TransformerOptimus

Name

• SuperAGI

Version

• 0.0.14

Website

• Product: https://github.com/TransformerOptimus/SuperAGI/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion