PT-2026-33719 · Unknown · Transformeroptimus/Superagi

Eric-Z · Published 2026-04-20 · Updated 2026-04-20 · CVE-2026-6612

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TransformerOptimus SuperAGI versions prior to 0.0.15

Description An authorization bypass exists in the Agent Execution Endpoint. A remote attacker can manipulate the agent execution id argument within the get agent execution() and update agent execution() functions located in the superagi/controllers/agent execution.py file to bypass authorization controls.

Recommendations Update to a version newer than 0.0.14. As a temporary workaround, restrict access to the get agent execution() and update agent execution() functions to minimize the risk of exploitation.

Exploit

Fix

Improper Authorization

IDOR

Weakness Enumeration

CWE-285

CWE-639

Related Identifiers

CVE-2026-6612

Affected Products

Transformeroptimus/Superagi

References · 6

• 🔥 https://gist.github.com/YLChen-007/d033e9d4d23e0832b9ede71dc545ac9a · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6612 · Security Note
• https://vuldb.com/submit/791078 · Note
• https://vuldb.com/vuln/358247/cti · Note
• https://vuldb.com/vuln/358247 · Note
• https://twitter.com/VulmonFeeds/status/2046180127810126314 · Twitter Post