CVE-2026-123786 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
Agenta, an LLM application platform, lets workspace members with workflow edit rights set arbitrary revision URLs that workflow invocations are redirected to. An attacker can capture the secret-resolve Authorization token and read provider secrets from the vault API, or reach internal and cloud metadata addresses.
first public Oct 12, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that self-host Agenta before 0.122.5 and let several members edit workflows in shared workspaces. The attacker needs workflow edit rights in a workspace, so single-user or fully trusted installs carry less risk. Teams on managed hosting should confirm with the provider which version they run.
Not affected if single-trusted-user, version-0.122.5-or-later
Who cares agenta, llm-ops, self-hosted, vault
0.122.5 are affected.0.122.5 or later.Agenta before 0.122.5 contains a server-side request forgery vulnerability that allows workspace members with workflow edit rights to redirect workflow invocations by setting arbitrary revision URLs. Attackers can capture the attached secret-resolve Authorization token to read provider secrets from the vault API, or reach internal and cloud metadata addresses.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.