PT-2026-33652 · Transformeroptimus · Superagi

Eric-Z · Publicado 2026-04-19 · Atualizado 2026-04-19 · CVE-2026-6583

NVD

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:P

A vulnerability has been found in TransformerOptimus SuperAGI up to 0.0.14. This affects the function delete api key/edit api key of the file superagi/controllers/api key.py of the component API Key Management Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Exploit

Correção

IDOR

Improper Authorization

Enumeração de Fraquezas

CWE-639

CWE-285

Identificadores relacionados

CVE-2026-6583

Produtos afetados

Superagi

Referências · 5

• 🔥 https://gist.github.com/YLChen-007/ba28ac92d9fd011d40560dbf2bac39ce · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6583 · Nota de Segurança
• https://vuldb.com/vuln/358218/cti · Nota
• https://vuldb.com/submit/791074 · Nota
• https://vuldb.com/vuln/358218 · Nota