What’s Vulnerable › Vulnerabilities

CVE-2026-6583: TransformerOptimus SuperAGI API Key Management Endpoint api_key.py edit_api_key authorization

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-19 · updated 2026-10-26
• Weakness: CWE-285

Description

A vulnerability has been found in TransformerOptimus SuperAGI up to 0.0.14. This affects the function delete_api_key/edit_api_key of the file superagi/controllers/api_key.py of the component API Key Management Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

• TransformerOptimus SuperAGI: 0.0.1, 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6 (+8)

References

• https://gist.github.com/YLChen-007/ba28ac92d9fd011d40560dbf2bac39ce
• https://vuldb.com/submit/791074
• https://vuldb.com/vuln/358218
• https://vuldb.com/vuln/358218/cti

Get alerted when CVE-2026-6583 or the next vulnerability affects your stack