Unauthenticated Access in TransformerOptimus SuperAGI Vector DB

A critical authentication bypass vulnerability, CVE-2026-6582, has been identified in TransformerOptimus SuperAGI versions up to 0.0.14. According to the National Vulnerability Database, the flaw resides in the get_vector_db_details function within the superagi/controllers/vector_dbs.py file, impacting the Vector Database Management Endpoint. This allows remote attackers to execute manipulations without authentication.

This isn’t just a theoretical issue; the exploit has been publicly disclosed, meaning attackers can leverage it immediately. The National Vulnerability Database also highlights that the vendor did not respond to early disclosure attempts, leaving users exposed. With a CVSS score of 7.3 (HIGH), this vulnerability presents a significant risk for data exposure and unauthorized access to vector database details.

For defenders, this is a clear call to action. Unauthenticated access to vector database details can expose sensitive information about AI models, data schemas, and potentially the underlying data itself. This could be leveraged for further reconnaissance, data exfiltration, or to manipulate AI responses, directly impacting data integrity and confidentiality. The attacker’s calculus here is simple: find unpatched instances and walk right in.