提交 #791085: SuperAGI up to c3c1982 Exposure of Sensitive Information (CWE-200)

# Technical Details
An Information Disclosure vulnerability exists in the `get_vector_db_details` function in `superagi/controllers/vector_dbs.py` of SuperAGI.

The application fails to enforce authentication on the `GET /vector_dbs/db/details/{vector_db_id}` endpoint, allowing any unauthenticated attacker to retrieve full Vector DB configuration details — including plaintext API keys for Pinecone, Qdrant, and Weaviate.

# Vulnerable Code
File: superagi/controllers/vector_dbs.py (lines 35-50)
Method: get_vector_db_details
Why: The route is registered without any `Depends(check_auth)` or `Depends(get_user_organisation)` dependency, unlike other sensitive endpoints in the same file. The method calls `VectordbConfigs.get_vector_db_config_from_db_id()` which returns all key-value pairs including `api_key`, `environment`, `url`, and `port` merged directly into the response.

# Reproduction
1. Ensure SuperAGI is running with at least one Vector DB configured.
2. Send an unauthenticated request to enumerate Vector DB details:
curl -s http://TARGET:3000/vector_dbs/db/details/1
3. The response returns full configuration including plaintext API keys (e.g., Pinecone api_key and environment).

# Impact
- API Key Theft: Unauthenticated attacker obtains plaintext API keys for external vector database services.
- Data Exfiltration: With the stolen keys, attacker can read all vector embeddings containing sensitive business knowledge.
- Data Poisoning: Attacker can modify or delete embeddings, corrupting the AI agent's knowledge base.
- Financial Abuse: Attacker can incur usage costs on the victim's API account.

• 来源: ⚠️ https://gist.github.com/YLChen-007/dd5bdf562d986d44b2a058d5c95e14e1
• 用户: Eric-y (UID 95889)
• 提交: 2026-03-27 13時05分 (28 日前)
• 管理: 2026-04-20 07時36分 (24 days later)
• 状态: 重复
• VulDB条目: 358217 [TransformerOptimus SuperAGI 直到 0.0.14 Vector Database Management Endpoint vector_dbs.py 弱身份验证]
• 积分: 0