CVE-2026-6582

BRIEFING NOTE - CVE-2026-6582 TransformerOptimus SuperAGI versions up to 0.0.14 contain an authentication bypass vulnerability in the Vector Database Management Endpoint. The flaw exists in the get_vector_db_details function within superagi/controllers/vector_dbs.py, allowing unauthenticated access to sensitive vector database details. This vulnerability affects the core database management functionality of the application. The vulnerability carries a CVSS v3.1 score of 7.3 (HIGH) with a network-based attack vector requiring no authentication, no special conditions, and no user interaction. The attack is of low complexity and results in low-level impacts to confidentiality, integrity, and availability. The FAUCET Risk Score of 47.0/100 indicates moderate concern within the broader vulnerability landscape. Exploit code has been publicly released and is available for potential attackers to leverage. Although the vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog, it appears on the active Hot List, suggesting community attention and ongoing monitoring. The vendor was notified during responsible disclosure but provided no response, leaving users without official remediation guidance. Organizations running affected versions should prioritize patching or implementing network controls to restrict access to the Vector Database Management Endpoint.