Superagi CVE-2026-6582

Remote unauthenticated exploitation against default configurations of SuperAGI ≤0.0.14 where the vector database management API endpoint is network-accessible. No authentication, special privileges, or user interaction required per CVSS vector (PR:N/UI:N). Exploitation limited to instances that: (1) expose the /vector_dbs HTTP endpoint to untrusted networks (not firewalled or reverse-proxied with auth), and (2) have vector database integrations configured (ChromaDB, Pinecone, Weaviate, etc.)-the endpoint has no value if no vector DBs are provisioned. Scope unchanged (S:U) per CVSS indicates impact confined to the vector database component, not full system takeover. Attack complexity is low (AC:L) because the flaw is in missing authentication logic, not a race condition or complex parser bug. Does NOT require: local access, admin privileges, or specific deployment modes beyond network exposure.

CVSS 7.3 (High) with network attack vector (AV:N), low complexity (AC:L), and no required privileges (PR:N) or user interaction (UI:N) indicates trivially exploitable remote access. Impact is rated Low across confidentiality, integrity, and availability (C:L/I:L/A:L), but real-world consequences for AI systems are amplified: unauthorized extraction of proprietary embeddings (data exfiltration), injection of poisoned vectors (model manipulation), or deletion of knowledge bases (operational disruption). The E:P temporal modifier confirms Proof-of-Concept exploit code exists (GitHub Gist published by YLChen-007), lowering exploitation barrier. However, CVSS alone may overstate urgency: the RL:X (remediation level undefined) and vendor non-responsiveness per VulDB suggest patching uncertainty. No CISA KEV listing indicates exploitation not yet widespread, despite public POC. EPSS score absent-cannot assess probabilistic exploitation risk. SSVC decision point: exploitation is POSSIBLE (POC available) but not confirmed ACTIVE, automatable (AV:N/AC:L), and technical impact PARTIAL (limited to vector DB scope, not full system compromise). Priority depends on whether SuperAGI deployment exposes the endpoint publicly and contains sensitive embeddings. Missing data: production usage statistics, whether endpoint requires network exposure in typical deployments, and actual vendor patch timeline.

An external attacker discovers a publicly exposed SuperAGI instance (e.g., via Shodan search for default ports or API signatures). Using the published GitHub Gist POC, they send unauthenticated HTTP requests to the /vector_dbs endpoint to enumerate configured vector databases, extract API keys for third-party embedding services (Pinecone credentials), download proprietary document embeddings used for RAG workflows, or inject malicious vectors that poison agent responses. The low attack complexity (AC:L) and remote vector (AV:N) enable scripted mass exploitation.