{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aagentaagenta/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:agenta:agenta:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.5,"id":"CVE-2026-123786"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Agenta (\u003c 0.122.5)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Agenta"],"content_html":"\u003cp\u003eAgenta before 0.122.5 contains a server-side request forgery vulnerability that allows workspace members with workflow edit rights to redirect workflow invocations by setting arbitrary revision URLs. Attackers can capture the attached secret-resolve Authorization token to read provider secrets from the vault API, or reach internal and cloud metadata addresses.\u003c/p\u003e\n","date_modified":"2026-11-06T17:26:18Z","date_published":"2026-11-06T17:26:18Z","id":"https://feed.craftedsignal.io/briefs/2026-11-agenta-ssrf/","summary":"Agenta versions before 0.122.5 contain a server-side request forgery vulnerability allowing workspace members with workflow edit rights to redirect workflow invocations via arbitrary revision URLs.","title":"Agenta: Server-side request forgery vulnerability (CVE-2026-123786)","url":"https://feed.craftedsignal.io/briefs/2026-11-agenta-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:agenta:agenta:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}