CVE-2026-6583

CVE-2026-6583 is an authorization bypass vulnerability discovered in TransformerOptimus SuperAGI versions up to 0.0.14, specifically affecting the API Key Management Endpoint in the delete_api_key and edit_api_key functions. This flaw allows unauthorized manipulation of API key operations, potentially compromising authentication mechanisms within the application. The vulnerability carries a CVSS v3.1 severity score of 5.4 (MEDIUM) with a network-based attack vector requiring low complexity and low privilege user authentication. While the integrity and availability impacts are limited, the authorization bypass nature of the issue presents a meaningful risk for privilege escalation and unauthorized data modification within affected systems. Exploitation status presents heightened concern as proof-of-concept code has been publicly disclosed, though current EPSS probability indicates relatively low active exploitation in the wild. The vendor was notified early in the disclosure process but did not engage in remediation efforts. The vulnerability currently appears on the Active Hot List, indicating ongoing community attention and potential for increased exploitation as awareness spreads among threat actors.