CVE-2026-6583

MEDIUM

TransformerOptimus SuperAGI API Key Management Endpoint api_key.py edit_api_key authorization

Title source: cna

Description

A vulnerability has been found in TransformerOptimus SuperAGI up to 0.0.14. This affects the function delete_api_key/edit_api_key of the file superagi/controllers/api_key.py of the component API Key Management Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4

Core References

Third Party Advisory third-party-advisory

Submit #791074 | SuperAGI SuperAGI up to c3c1982 Authorization Bypass Through User-Controlled Key (CWE-639)

https://vuldb.com/submit/791074

Exploit exploit

https://gist.github.com/YLChen-007/ba28ac92d9fd011d40560dbf2bac39ce

Vdb Entry, Technical Description vdb-entry technical-description

VDB-358218 | TransformerOptimus SuperAGI API Key Management Endpoint api_key.py edit_api_key authorization

https://vuldb.com/vuln/358218

Signature, Permissions Required signature permissions-required

VDB-358218 | CTI Indicators (IOB, IOC, IOA)

https://vuldb.com/vuln/358218/cti

Scores

CVSS v3 5.4

EPSS 0.0030

EPSS Percentile 21.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-285 CWE-639

Status published

Products (14)

TransformerOptimus/SuperAGI 0.0.1

TransformerOptimus/SuperAGI 0.0.10

TransformerOptimus/SuperAGI 0.0.11

TransformerOptimus/SuperAGI 0.0.12

TransformerOptimus/SuperAGI 0.0.13

TransformerOptimus/SuperAGI 0.0.14

TransformerOptimus/SuperAGI 0.0.2

TransformerOptimus/SuperAGI 0.0.3

TransformerOptimus/SuperAGI 0.0.4

TransformerOptimus/SuperAGI 0.0.5

... and 4 more

Published Apr 19, 2026

Tracked Since Apr 20, 2026