CVE-2026-123786

Summary

Agenta before 0.122.5 has a server-side request forgery (SSRF) flaw where users with workflow edit permissions can set arbitrary revision URLs, causing the server to make unintended requests. This allows attackers to exfiltrate the secret-resolve Authorization token and access sensitive provider secrets or internal/cloud metadata endpoints.

Exploitability

Exploitation requires low skill and only a workspace membership with workflow edit rights; no user interaction or external tools are needed beyond standard HTTP requests.

Blast radius

Successful exploitation enables full compromise of cloud provider secrets stored in the vault, potential access to internal infrastructure via metadata endpoints, and limited integrity impact through forced server-side actions.

Detection

Defenders should monitor for anomalous outbound HTTP requests from the Agenta application to unexpected external domains or internal IP ranges (e.g., 169.254.169.254), especially those including Authorization headers containing secret-resolve tokens; log entries showing workflow invocations with non-standard revision URLs pointing to untrusted domains may also indicate exploitation attempts.

Prioritized remediation

Upgrade to Agenta version 0.122.5 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.