CVE-2026-6586

CVE-2026-6586 is an authorization bypass vulnerability affecting TransformerOptimus SuperAGI versions up to 0.0.14, specifically in the Budget Endpoint functions get_budget and update_budget within the budget.py controller file. This flaw allows authenticated attackers to circumvent access controls and manipulate budget data without proper authorization. The vulnerability carries a CVSS score of 6.3 (medium severity) with a network-based attack vector requiring low complexity and low privileges. The attack can result in confidentiality, integrity, and availability impacts, though each is rated as low. The FAUCET Risk Score of 44.0 reflects moderate concern within the security community. Exploitation status indicates active interest in the vulnerability with publicly available exploit code, increasing the risk of widespread attacks. The vulnerability appears on active threat lists, though it has not yet achieved critical incident status. The vendor's lack of response to early disclosure notifications is a significant concern for affected organizations relying on SuperAGI, as patches or mitigations may not be forthcoming.