PT-2026-33651 · Transformeroptimus · Superagi

Eric-Z · CVE-2026-6582 · Published 2026-04-19 · Updated 2026-04-28

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TransformerOptimus SuperAGI versions prior to 0.0.15

Description A flaw in the Vector Database Management Endpoint allows remote attackers to bypass authentication. The issue exists within the get vector db details() function located in the superagi/controllers/vector dbs.py file.

Recommendations Update to a version newer than 0.0.14. As a temporary workaround, restrict access to the get vector db details() function to minimize the risk of exploitation.

Exploit

Fix

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-306

CWE-287

Related Identifiers

CVE-2026-6582

Affected Products

Superagi

References · 6

• 🔥 https://gist.github.com/YLChen-007/f38b32a9cd0c9722e04a716ca4dbf9d5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6582 · Security Note
• https://vuldb.com/vuln/358217/cti · Note
• https://twitter.com/giuseppe_1337/status/2048956693162152284 · Twitter Post
• https://vuldb.com/vuln/358217 · Note
• https://vuldb.com/submit/791072 · Note