This vulnerability affects the TransformerOptimus SuperAGI product, specifically the get_vector_db_details function in the superagi/controllers/vector_dbs.py file. The issue is a missing authentication control, which can be triggered remotely, allowing unauthorized access to vector database details. The CVSS 4.0 score is 6.9 (medium severity), reflecting network attack vector, no privileges or user interaction required, and low to limited confidentiality, integrity, and availability impacts. No official remediation or patch has been provided by the vendor, and the exploit code is publicly available.

An attacker can remotely access the get_vector_db_details endpoint without authentication, potentially exposing sensitive vector database information or enabling unauthorized manipulation. The impact is rated medium severity, with limited confidentiality, integrity, and availability consequences. There is no indication of widespread exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing compensating controls such as restricting network access to the affected endpoint, using external authentication proxies, or monitoring for suspicious activity targeting this function until an official patch is available.