What’s Vulnerable › Vulnerabilities

CVE-2026-6586: TransformerOptimus SuperAGI Budget Endpoint budget.py update_budget authorization

• Severity: medium (CVSS 6.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-20 · updated 2026-10-26
• Weakness: CWE-285

Description

A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14. Impacted is the function get_budget/update_budget of the file superagi/controllers/budget.py of the component Budget Endpoint. Such manipulation leads to authorization bypass. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

• TransformerOptimus SuperAGI: 0.0.1, 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6 (+8)

References

• https://gist.github.com/YLChen-007/4b6b95f98aeed927a99d2a76eaf53444
• https://vuldb.com/submit/791077
• https://vuldb.com/vuln/358221
• https://vuldb.com/vuln/358221/cti

Get alerted when CVE-2026-6586 or the next vulnerability affects your stack