Server-Side Request Forgery Vulnerability in TransformerOptimus SuperAGI WebScraperTool
CVE-2026-6616

5.3MEDIUM

Key Information:

Vendor: Transformeroptimus
Status: Superagi
Vendor: CVE Published:; 20 April 2026

🔔 Create Transformeroptimus Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-6616?

A security vulnerability has been found in the TransformerOptimus SuperAGI, specifically affecting the WebScraperTool component. The flaw resides in the functions extract_with_bs4, extract_with_3k, and extract_with_lxml located in the superagi/helper/webpage_extractor.py file. This vulnerability allows attackers to exploit server-side request forgery (SSRF), enabling them to manipulate requests and potentially access sensitive information from internal systems. The risk is heightened as the vulnerability can be exploited remotely, and attackers may use publicly disclosed exploit techniques. Despite being contacted regarding this issue, the vendor has not provided a response.

Affected Version(s)

SuperAGI 0.0.1

SuperAGI 0.0.2

SuperAGI 0.0.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-6616 - Proof of Concept