CVE-2026-108739: falha de alta gravidade em openagents-org OpenAgents
OpenAgents Workspace through launcher-v1.0.17 Unauthenticated Credential Exposure via /v1/workspaces
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.3%
OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers to list all workspaces via GET /v1/workspaces. Attackers can read the unmasked browserfabric_api_key in each workspace's settings map, along with workspace ids, slugs, creator emails and member lists.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
openagents-org · OpenAgentsReferências
https://github.com/openagents-org/openagentshttps://github.com/openagents-org/openagents/blob/0824907096d4039d86dfc96b81f9eebf31a77ae7/workspace/backend/app/routers/workspaces.py#L135-L177https://github.com/openagents-org/openagents/blob/0824907096d4039d86dfc96b81f9eebf31a77ae7/workspace/backend/app/routers/workspaces.py#L326-L349https://hackmd.io/@haind/openagents-workspace-list-browserfabric-key-disclosurehttps://www.vulncheck.com/advisories/openagents-workspace-through-launcher-1.0.17-unauthenticated-credential-exposure-via-v1-workspaces