CVE-2026-108739

Summary

The OpenAgents Workspace backend has an information disclosure vulnerability that allows unauthenticated attackers to list all workspaces and access sensitive API keys and user information. This flaw enables attackers to obtain browserfabric_api_key values without authentication, potentially leading to unauthorized access to workspace resources.

Exploitability

Exploitation is straightforward requiring only a GET request to /v1/workspaces endpoint with no authentication prerequisites.

Blast radius

The vulnerability could impact all workspaces in the system, exposing API keys that may grant access to additional services and potentially allowing attackers to pivot into other workspace resources or user accounts.

Detection

Monitor for unauthenticated GET requests to /v1/workspaces endpoint in web server logs, specifically looking for requests without authentication headers that return JSON responses containing workspace details and API keys.

Prioritized remediation

Apply the patch for launcher-v1.0.17 which contains the fix for this information disclosure vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.