CVE-2026-6583: medium-severity vulnerability in TransformerOptimus SuperAGI
TransformerOptimus SuperAGI API Key Management Endpoint api_key.py edit_api_key authorization
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.3%
A vulnerability has been found in TransformerOptimus SuperAGI up to 0.0.14. This affects the function delete_api_key/edit_api_key of the file superagi/controllers/api_key.py of the component API Key Management Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
TransformerOptimus · SuperAGIpublic PoCs found — 1
cve_referencegist.github.com/YLChen-007/ba28ac92d9fd011d40560dbf2bac39ceunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — TransformerOptimus SuperAGI
In the same product, most dangerous first.
CVE-2025-6280MEDIUMTransformerOptimus SuperAGI EmailToolKit read_email.py download_attachment path traversalEPSS 0.6%CVE-2026-6615MEDIUMTransformerOptimus SuperAGI Multipart Upload resources.py upload path traversalEPSS 0.5%CVE-2026-6582MEDIUMTransformerOptimus SuperAGI Vector Database Management Endpoint vector_dbs.py get_vector_db_details missing authenticationEPSS 0.4%CVE-2026-6612MEDIUMTransformerOptimus SuperAGI Agent Execution Endpoint agent_execution.py update_agent_execution authorizationEPSS 0.3%CVE-2026-6585MEDIUMTransformerOptimus SuperAGI Organisation Update Endpoint organisation.py update_organisation authorizationEPSS 0.3%CVE-2026-6584MEDIUMTransformerOptimus SuperAGI User Update Endpoint user.py update_user authorizationEPSS 0.3%