{"id":"CVE-2026-123786","kind":"vulnerability","aliases":["CVE-2026-123786"],"related":[],"title":"Agenta: workflow revision URLs let members steal vault provider secrets","description":"Agenta before 0.122.5 contains a server-side request forgery vulnerability that allows workspace members with workflow edit rights to redirect workflow invocations by setting arbitrary revision URLs. Attackers can capture the attached secret-resolve Authorization token to read provider secrets from the vault API, or reach internal and cloud metadata addresses.","summary":"Agenta, an LLM application platform, lets workspace members with workflow edit rights set arbitrary revision URLs that workflow invocations are redirected to. An attacker can capture the secret-resolve Authorization token and read provider secrets from the vault API, or reach internal and cloud metadata addresses.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["agenta","ai-tooling","llm-ops","self-hosted","vault"],"not_affected_if":["single-trusted-user","version-0.122.5-or-later"],"how_to_check":"- Check the installed Agenta version; the sources say versions before `0.122.5` are affected.\n- Review which users hold workflow edit rights in each workspace.","fix":"- Upgrade Agenta to `0.122.5` or later.","status":"open","published_at":"2026-11-06T15:17:21+00:00","first_seen_at":"2026-11-06T15:42:44+00:00","triaged_at":"2026-11-06T15:44:10+00:00","updated_at":"2026-11-06T15:44:10+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-06T15:44:10Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Agenta to `0.122.5` or later.","reach":"network","title":"Agenta: workflow revision URLs let members steal vault provider secrets","impact":"high","summary":"Agenta, an LLM application platform, lets workspace members with workflow edit rights set arbitrary revision URLs that workflow invocations are redirected to. An attacker can capture the secret-resolve Authorization token and read provider secrets from the vault API, or reach internal and cloud metadata addresses.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["agenta","self-hosted","llm-ops","vault"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Provider secrets read from the vault; internal and cloud metadata reached","analyst_note":"Confirm the exact affected range and the fix commit or release notes from the linked vendor advisory and patch pages; the sources given here do not state the affected range beyond 'before 0.122.5'.","how_to_check":"- Check the installed Agenta version; the sources say versions before `0.122.5` are affected.\n- Review which users hold workflow edit rights in each workspace.","plain_action":"","needs_analyst":true,"not_affected_if":["version-0.122.5-or-later","single-trusted-user"],"who_is_affected":"Teams that self-host Agenta before 0.122.5 and let several members edit workflows in shared workspaces. The attacker needs workflow edit rights in a workspace, so single-user or fully trusted installs carry less risk. Teams on managed hosting should confirm with the provider which version they run.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000732,"input_tokens":4323,"output_tokens":599,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123786':13A,16A '-2026':12A,15A '0.122.5':77C 'address':74B,127C 'agenta':1A,17B,28B,75C 'ai':19B 'ai-tool':18B 'allow':87C 'api':67B,120C 'applic':31B 'arbitrari':41B,100C 'attach':107C 'attack':51B,103C 'author':58B,111C 'captur':53B,105C 'cloud':72B,125C 'contain':78C 'cve':11A,14A 'edit':38B,92C 'forgeri':84C 'host':26B 'intern':70B,123C 'invoc':46B,97C 'let':5A,33B 'llm':22B,30B 'llm-op':21B 'member':6A,35B,89C 'metadata':73B,126C 'op':23B 'platform':32B 'provid':9A,62B,115C 'reach':69B,122C 'read':61B,114C 'redirect':48B,95C 'request':83C 'resolv':57B,110C 'revis':3A,42B,101C 'right':39B,93C 'secret':10A,56B,63B,109C,116C 'secret-resolv':55B,108C 'self':25B 'self-host':24B 'server':81C 'server-sid':80C 'set':40B,99C 'side':82C 'steal':7A 'token':59B,112C 'tool':20B 'url':4A,43B,102C 'vault':8A,27B,66B,119C 'vulner':85C 'workflow':2A,37B,45B,91C,96C 'workspac':34B,88C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Agenta before 0.122.5 and let several members edit workflows in shared workspaces. The attacker needs workflow edit rights in a workspace, so single-user or fully trusted installs carry less risk. Teams on managed hosting should confirm with the provider which version they run.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["agenta","aitooling","high","llmops","selfhosted","vault"],"campaign_type":null,"search_a":"'-123786':13A,16A '-2026':12A,15A 'agenta':1A 'cve':11A,14A 'let':5A 'member':6A 'provid':9A 'revis':3A 'secret':10A 'steal':7A 'url':4A 'vault':8A 'workflow':2A","search_b":"'address':74B 'agenta':17B,28B 'ai':19B 'ai-tool':18B 'api':67B 'applic':31B 'arbitrari':41B 'attack':51B 'author':58B 'captur':53B 'cloud':72B 'edit':38B 'host':26B 'intern':70B 'invoc':46B 'let':33B 'llm':22B,30B 'llm-op':21B 'member':35B 'metadata':73B 'op':23B 'platform':32B 'provid':62B 'reach':69B 'read':61B 'redirect':48B 'resolv':57B 'revis':42B 'right':39B 'secret':56B,63B 'secret-resolv':55B 'self':25B 'self-host':24B 'set':40B 'token':59B 'tool':20B 'url':43B 'vault':27B,66B 'workflow':37B,45B 'workspac':34B","search_c":"'0.122.5':77C 'address':127C 'agenta':75C 'allow':87C 'api':120C 'arbitrari':100C 'attach':107C 'attack':103C 'author':111C 'captur':105C 'cloud':125C 'contain':78C 'edit':92C 'forgeri':84C 'intern':123C 'invoc':97C 'member':89C 'metadata':126C 'provid':115C 'reach':122C 'read':114C 'redirect':95C 'request':83C 'resolv':110C 'revis':101C 'right':93C 'secret':109C,116C 'secret-resolv':108C 'server':81C 'server-sid':80C 'set':99C 'side':82C 'token':112C 'url':102C 'vault':119C 'vulner':85C 'workflow':91C,96C 'workspac':88C","first_public_at":"2026-10-12T18:58:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123786","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123786","severity":null,"published_at":"2026-11-06T15:17:21+00:00","modified_at":"2026-11-06T15:17:21+00:00","first_seen_at":"2026-11-06T15:42:44+00:00","fetched_at":"2026-11-06T15:42:44+00:00","note":null}],"documents":[{"id":87596,"url":"https://github.com/Agenta-AI/agenta/commit/95fedd72a8b2bab810f80907f58c09f8bb579d94","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":87597,"url":"https://github.com/Agenta-AI/agenta/releases/tag/v0.122.5","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":87598,"url":"https://github.com/Agenta-AI/agenta/security/advisories/GHSA-pr74-8wxx-gj2h","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-12T18:59:13+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":87599,"url":"https://github.com/Agenta-AI/agenta/security/advisories/GHSA-wx6j-82pp-wx76","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-12T18:58:56+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":87600,"url":"https://www.vulncheck.com/advisories/agenta-before-0.122.5-ssrf-via-workflow-revision-url-leaks-secret-token","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}