Search
Find a vulnerability
Search criteria
3 vulnerabilities by Agenta-AI
CVE-2026-123786 (GCVE-0-2026-123786)
Vulnerability from cvelistv5 – Published: 2026-11-06 15:01 – Updated: 2026-11-09 22:45
VLAI
EPSS
VEX
Title
Agenta before 0.122.5 SSRF via Workflow Revision URL Leaks Secret Token
Summary
Agenta before 0.122.5 contains a server-side request forgery vulnerability that allows workspace members with workflow edit rights to redirect workflow invocations by setting arbitrary revision URLs. Attackers can capture the attached secret-resolve Authorization token to read provider secrets from the vault API, or reach internal and cloud metadata addresses.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 22:34 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck
CNA
References
7 references
| URL | Tags |
|---|---|
| https://github.com/Agenta-AI/agenta/security/advi… | vendor-advisory |
| https://github.com/Agenta-AI/agenta/security/advi… | vendor-advisory |
| https://github.com/Agenta-AI/agenta/pull/7530 | issue-trackingpatch |
| https://github.com/Agenta-AI/agenta/commit/95fedd… | patch |
| https://github.com/Agenta-AI/agenta/releases/tag/… | release-notes |
| https://github.com/Agenta-AI/agenta/blob/v0.122.4… | technical-description |
| https://www.vulncheck.com/advisories/agenta-befor… | third-party-advisory |
Impacted products
Date Public
2026-10-12 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123786",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T22:34:41.724702Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T22:45:28.161Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/Agenta-AI/agenta",
"product": "agenta",
"repo": "https://github.com/Agenta-AI/agenta",
"vendor": "Agenta-AI",
"versions": [
{
"lessThan": "0.122.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:agentatech:agenta:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.122.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "William Goodfellow"
},
{
"lang": "en",
"type": "finder",
"value": "Syed Anas Mohiuddin"
},
{
"lang": "en",
"type": "finder",
"value": "Bandana (HackWitHer), APIsec Research Labs"
}
],
"datePublic": "2026-10-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Agenta before 0.122.5 contains a server-side request forgery vulnerability that allows workspace members with workflow edit rights to redirect workflow invocations by setting arbitrary revision URLs. Attackers can capture the attached secret-resolve Authorization token to read provider secrets from the vault API, or reach internal and cloud metadata addresses."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:01:02.112Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-pr74-8wxx-gj2h)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/Agenta-AI/agenta/security/advisories/GHSA-pr74-8wxx-gj2h"
},
{
"name": "GitHub Security Advisory (GHSA-wx6j-82pp-wx76)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/Agenta-AI/agenta/security/advisories/GHSA-wx6j-82pp-wx76"
},
{
"name": "Fix pull request #7530",
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/Agenta-AI/agenta/pull/7530"
},
{
"name": "Fix merge commit",
"tags": [
"patch"
],
"url": "https://github.com/Agenta-AI/agenta/commit/95fedd72a8b2bab810f80907f58c09f8bb579d94"
},
{
"name": "agenta v0.122.5 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/Agenta-AI/agenta/releases/tag/v0.122.5"
},
{
"name": "Outbound request in WorkflowsService",
"tags": [
"technical-description"
],
"url": "https://github.com/Agenta-AI/agenta/blob/v0.122.4/api/oss/src/core/workflows/service.py#L785-L805"
},
{
"name": "VulnCheck Advisory: Agenta before 0.122.5 SSRF via Workflow Revision URL Leaks Secret Token",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/agenta-before-0.122.5-ssrf-via-workflow-revision-url-leaks-secret-token"
}
],
"title": "Agenta before 0.122.5 SSRF via Workflow Revision URL Leaks Secret Token",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123786",
"datePublished": "2026-11-06T15:01:02.112Z",
"dateReserved": "2026-11-06T14:37:46.810Z",
"dateUpdated": "2026-11-09T22:45:28.161Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-27961 (GCVE-0-2026-27961)
Vulnerability from cvelistv5 – Published: 2026-02-26 01:39 – Updated: 2026-02-26 19:29
VLAI
EPSS
VEX
Title
Agenta's Server-Side Template Injection (SSTI) via custom evaluator Jinja2 templates allows RCE
Summary
Agenta is an open-source LLMOps platform. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 0.86.8 in Agenta's API server evaluator template rendering. Although the vulnerable code lives in the SDK package, it is executed server-side within the API process when running evaluators. This does not affect standalone SDK usage — it only impacts self-hosted or managed Agenta platform deployments. Version 0.86.8 contains a fix for the issue.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-26 19:28 UTC
CWE
- CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
Assigner
GitHub_M
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/Agenta-AI/agenta/security/advi… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-27961",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-26T19:28:54.001382Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T19:29:04.883Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "agenta",
"vendor": "Agenta-AI",
"versions": [
{
"status": "affected",
"version": "\u003c 0.86.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Agenta is an open-source LLMOps platform. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 0.86.8 in Agenta\u0027s API server evaluator template rendering. Although the vulnerable code lives in the SDK package, it is executed server-side within the API process when running evaluators. This does not affect standalone SDK usage \u2014 it only impacts self-hosted or managed Agenta platform deployments. Version 0.86.8 contains a fix for the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T01:39:09.997Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Agenta-AI/agenta/security/advisories/GHSA-cfr2-mp74-3763",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Agenta-AI/agenta/security/advisories/GHSA-cfr2-mp74-3763"
}
],
"source": {
"advisory": "GHSA-cfr2-mp74-3763",
"discovery": "UNKNOWN"
},
"title": "Agenta\u0027s Server-Side Template Injection (SSTI) via custom evaluator Jinja2 templates allows RCE"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-27961",
"datePublished": "2026-02-26T01:39:09.997Z",
"dateReserved": "2026-02-25T03:24:57.792Z",
"dateUpdated": "2026-02-26T19:29:04.883Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-27952 (GCVE-0-2026-27952)
Vulnerability from cvelistv5 – Published: 2026-02-26 01:38 – Updated: 2026-02-26 19:27
VLAI
EPSS
VEX
Title
Agenta has Python Sandbox Escape, Leading to Remote Code Execution (RCE)
Summary
Agenta is an open-source LLMOps platform. In Agenta-API prior to version 0.48.1, a Python sandbox escape vulnerability existed in Agenta's custom code evaluator. Agenta used RestrictedPython as a sandboxing mechanism for user-supplied evaluator code, but incorrectly whitelisted the `numpy` package as safe within the sandbox. This allowed authenticated users to bypass the sandbox and achieve arbitrary code execution on the API server. The escape path was through `numpy.ma.core.inspect`, which exposes Python's introspection utilities — including `sys.modules` — thereby providing access to unfiltered system-level functionality like `os.system`. This vulnerability affects the Agenta self-hosted platform (API server), not the SDK when used as a standalone Python library. The custom code evaluator runs server-side within the API process. The issue is fixed in v0.48.1 by removing `numpy` from the sandbox allowlist. In later versions (v0.60+), the RestrictedPython sandbox was removed entirely and replaced with a different execution model.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-26 19:27 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
GitHub_M
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/Agenta-AI/agenta/security/advi… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Agenta-AI | agenta-api |
Affected:
< 0.48.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-27952",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-26T19:27:13.151791Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T19:27:29.328Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "agenta-api",
"vendor": "Agenta-AI",
"versions": [
{
"status": "affected",
"version": "\u003c 0.48.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Agenta is an open-source LLMOps platform. In Agenta-API prior to version 0.48.1, a Python sandbox escape vulnerability existed in Agenta\u0027s custom code evaluator. Agenta used RestrictedPython as a sandboxing mechanism for user-supplied evaluator code, but incorrectly whitelisted the `numpy` package as safe within the sandbox. This allowed authenticated users to bypass the sandbox and achieve arbitrary code execution on the API server. The escape path was through `numpy.ma.core.inspect`, which exposes Python\u0027s introspection utilities \u2014 including `sys.modules` \u2014 thereby providing access to unfiltered system-level functionality like `os.system`. This vulnerability affects the Agenta self-hosted platform (API server), not the SDK when used as a standalone Python library. The custom code evaluator runs server-side within the API process. The issue is fixed in v0.48.1 by removing `numpy` from the sandbox allowlist. In later versions (v0.60+), the RestrictedPython sandbox was removed entirely and replaced with a different execution model."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T01:38:00.760Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Agenta-AI/agenta/security/advisories/GHSA-pmgp-2m3v-34mq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Agenta-AI/agenta/security/advisories/GHSA-pmgp-2m3v-34mq"
}
],
"source": {
"advisory": "GHSA-pmgp-2m3v-34mq",
"discovery": "UNKNOWN"
},
"title": "Agenta has Python Sandbox Escape, Leading to Remote Code Execution (RCE)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-27952",
"datePublished": "2026-02-26T01:38:00.760Z",
"dateReserved": "2026-02-25T03:11:36.690Z",
"dateUpdated": "2026-02-26T19:27:29.328Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}