Agenta: Server-side request forgery vulnerability (CVE-2026-123786)
Agenta versions before 0.122.5 contain a server-side request forgery vulnerability allowing workspace members with workflow edit rights to redirect workflow invocations via arbitrary revision URLs.
CVE search metadata
CVE search record: CVE-2026-123786. Severity: high. CVSS: 8.5. KEV: no. Product: Agenta (< 0.122.5). Brief: Agenta: Server-side request forgery vulnerability (CVE-2026-123786). Brief link: https://feed.craftedsignal.io/briefs/2026-11-agenta-ssrf/
Triage facts
Revision 1- Applicability
- Agenta (< 0.122.5)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 6, 17:26 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Agenta before 0.122.5 contains a server-side request forgery vulnerability that allows workspace members with workflow edit rights to redirect workflow invocations by setting arbitrary revision URLs. Attackers can capture the attached secret-resolve Authorization token to read provider secrets from the vault API, or reach internal and cloud metadata addresses.