CVE-2026-6582

Summary

A flaw has been found in TransformerOptimus SuperAGI up to 0.0.14. Affected by this issue is the function get_vector_db_details of the file superagi/controllers/vector_dbs.py of the component Vector Database Management Endpoint. Executing a manipulation can lead to missing authentication. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

VendorProductVersion RangeStatus
TransformerOptimusSuperAGI0.0.1affected
TransformerOptimusSuperAGI0.0.2affected
TransformerOptimusSuperAGI0.0.3affected
TransformerOptimusSuperAGI0.0.4affected
TransformerOptimusSuperAGI0.0.5affected
TransformerOptimusSuperAGI0.0.6affected
TransformerOptimusSuperAGI0.0.7affected
TransformerOptimusSuperAGI0.0.8affected
TransformerOptimusSuperAGI0.0.9affected
TransformerOptimusSuperAGI0.0.10affected
TransformerOptimusSuperAGI0.0.11affected
TransformerOptimusSuperAGI0.0.12affected
TransformerOptimusSuperAGI0.0.13affected
TransformerOptimusSuperAGI0.0.14affected

Weaknesses

  • CWE-306: Missing Authentication
  • CWE-287: Improper Authentication

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: yes
    • Technical Impact: partial

References