제출 #791085: SuperAGI up to c3c1982 Exposure of Sensitive Information (CWE-200)

# Technical Details
An Information Disclosure vulnerability exists in the `get_vector_db_details` function in `superagi/controllers/vector_dbs.py` of SuperAGI.

The application fails to enforce authentication on the `GET /vector_dbs/db/details/{vector_db_id}` endpoint, allowing any unauthenticated attacker to retrieve full Vector DB configuration details — including plaintext API keys for Pinecone, Qdrant, and Weaviate.

# Vulnerable Code
File: superagi/controllers/vector_dbs.py (lines 35-50)
Method: get_vector_db_details
Why: The route is registered without any `Depends(check_auth)` or `Depends(get_user_organisation)` dependency, unlike other sensitive endpoints in the same file. The method calls `VectordbConfigs.get_vector_db_config_from_db_id()` which returns all key-value pairs including `api_key`, `environment`, `url`, and `port` merged directly into the response.

# Reproduction
1. Ensure SuperAGI is running with at least one Vector DB configured.
2. Send an unauthenticated request to enumerate Vector DB details:
curl -s http://TARGET:3000/vector_dbs/db/details/1
3. The response returns full configuration including plaintext API keys (e.g., Pinecone api_key and environment).

# Impact
- API Key Theft: Unauthenticated attacker obtains plaintext API keys for external vector database services.
- Data Exfiltration: With the stolen keys, attacker can read all vector embeddings containing sensitive business knowledge.
- Data Poisoning: Attacker can modify or delete embeddings, corrupting the AI agent's knowledge base.
- Financial Abuse: Attacker can incur usage costs on the victim's API account.

• 원천: ⚠️ https://gist.github.com/YLChen-007/dd5bdf562d986d44b2a058d5c95e14e1
• 사용자: Eric-y (UID 95889)
• 제출: 2026. 03. 27. PM 01:05 (25 날 ago)
• 모더레이션: 2026. 04. 20. AM 07:36 (24 days later)
• 상태: 중복
• VulDB 항목: 358217 [TransformerOptimus SuperAGI 까지 0.0.14 Vector Database Management Endpoint vector_dbs.py 약한 인증]
• 포인트들: 0