---
id: "CVE-2026-123786"
page: "https://infrastack.ai/live/CVE-2026-123786"
kind: "vulnerability"
aliases: ["CVE-2026-123786"]
title: "Agenta: workflow revision URLs let members steal vault provider secrets"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["agenta", "ai-tooling", "llm-ops", "self-hosted", "vault"]
not_affected_if: ["single-trusted-user", "version-0.122.5-or-later"]
published_at: "2026-11-06T15:17:21+00:00"
first_seen_at: "2026-11-06T15:42:44+00:00"
updated_at: "2026-11-06T15:44:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123786", "first_seen_at": "2026-11-06T15:42:44+00:00"}]
exploit_sources: []
---

# Agenta: workflow revision URLs let members steal vault provider secrets

Link for people: https://infrastack.ai/live/CVE-2026-123786 (this .md is for agents)

Agenta, an LLM application platform, lets workspace members with workflow edit rights set arbitrary revision URLs that workflow invocations are redirected to. An attacker can capture the secret-resolve Authorization token and read provider secrets from the vault API, or reach internal and cloud metadata addresses.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Agenta version; the sources say versions before `0.122.5` are affected.
- Review which users hold workflow edit rights in each workspace.

## Fix

- Upgrade Agenta to `0.122.5` or later.

## Timeline

- 2026-11-06T15:42:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123786

## Documents

- [advisory] Vendor advisory: github.com https://github.com/Agenta-AI/agenta/security/advisories/GHSA-pr74-8wxx-gj2h
- [advisory] Vendor advisory: github.com https://github.com/Agenta-AI/agenta/security/advisories/GHSA-wx6j-82pp-wx76
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/agenta-before-0.122.5-ssrf-via-workflow-revision-url-leaks-secret-token
- [fix] Patch: github.com https://github.com/Agenta-AI/agenta/commit/95fedd72a8b2bab810f80907f58c09f8bb579d94
- [fix] Release notes: github.com https://github.com/Agenta-AI/agenta/releases/tag/v0.122.5

## From the sources

Agenta before 0.122.5 contains a server-side request forgery vulnerability that allows workspace members with workflow edit rights to redirect workflow invocations by setting arbitrary revision URLs. Attackers can capture the attached secret-resolve Authorization token to read provider secrets from the vault API, or reach internal and cloud metadata addresses.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_