OpenAgents - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/openagents/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 11 Oct 2026 14:01:26 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgInformation Disclosure Vulnerability in OpenAgents Workspacehttps://feed.craftedsignal.io/briefs/2026-10-openagents-info-disclosure/Sun, 11 Oct 2026 14:01:26 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-openagents-info-disclosure/An information disclosure vulnerability in the OpenAgents Workspace backend allows unauthenticated attackers to exfiltrate workspace metadata and API keys via the /v1/workspaces endpoint.The OpenAgents Workspace backend, specifically versions through launcher-v1.0.17, contains a critical information disclosure vulnerability. This flaw resides in the /v1/workspaces API endpoint, which fails to properly authenticate requests. An unauthenticated remote attacker can issue a GET request to this endpoint to retrieve a comprehensive list of all workspaces within an organization's deployment. The response includes sensitive information such as internal workspace identifiers, URL slugs, lists of member email addresses, and the unmasked 'browserfabric_api_key'. Access to these API keys poses a significant risk of further exploitation, as they may be used to access external services or manipulate the underlying browser infrastructure associated with those workspaces. This vulnerability was identified as CVE-2026-108739.

Impact

Successful exploitation allows for the unauthorized mass exfiltration of organizational structure, internal user email addresses, and active API credentials. Exposure of the 'browserfabric_api_key' effectively grants an attacker the ability to hijack existing browser sessions or interact with the platform as an authenticated user, potentially leading to data theft or further unauthorized access to integrated systems.

Recommendation

Prioritize immediate patching of the OpenAgents Workspace backend. Upgrade all instances running version 1.0.17 or earlier to the latest secure version released by the vendor that addresses CVE-2026-108739. If immediate patching is not possible, implement a temporary restriction on external access to the /v1/workspaces API endpoint at the reverse proxy or WAF layer for all unauthenticated traffic.

]]>highadvisoryinformation-disclosureapi-securitycloud