CVE-2026-108739 in OpenAgents
Summary
by MITRE • 10/11/2026
OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers to list all workspaces via GET /v1/workspaces. Attackers can read the unmasked browserfabric_api_key in each workspace's settings map, along with workspace ids, slugs, creator emails and member lists.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The identified vulnerability within OpenAgents Workspace backend versions through launcher-v1.0.17 represents a critical information disclosure flaw rooted in insufficient access control mechanisms on the application programming interface endpoint GET /v1/workspaces. This architectural weakness allows unauthenticated actors to enumerate all existing workspaces without requiring valid authentication credentials or session tokens. The core technical failure lies in the server-side logic, which fails to enforce proper authorization checks before processing requests aimed at retrieving workspace metadata and configuration details. Consequently, any network actor with connectivity to the service can invoke this endpoint and receive a comprehensive response containing sensitive operational data that should be restricted to authorized administrators or members of specific workspaces.
The impact of this vulnerability extends beyond simple enumeration, as it facilitates the exfiltration of high-value secrets embedded within workspace configurations. Specifically, attackers are able to retrieve unmasked browserfabric_api_key values associated with each workspace's settings map. These API keys serve as primary authentication mechanisms for interacting with downstream services and data stores linked to the OpenAgents platform. The exposure of these credentials effectively grants unauthorized parties full operational control over the affected workspaces, enabling them to read, modify, or delete data, impersonate legitimate users, and potentially pivot into other connected systems that trust these API keys. This transforms a simple information leak into a severe compromise of confidentiality and integrity for all associated tenant environments.
In addition to credential theft, the vulnerability exposes significant amounts of personally identifiable information and organizational structure details. The response payload includes workspace identifiers, slugs which often reflect internal naming conventions or project names, creator email addresses, and complete member lists. This intelligence gathering capability allows attackers to map out the target organization's operational hierarchy, identify key personnel for targeted phishing campaigns, and understand the scope of assets under management. The combination of structural metadata and authentication secrets creates a potent attack vector that can be leveraged for further exploitation phases such as account takeover, data exfiltration, or ransomware deployment against exposed storage buckets if linked appropriately.
From a classification perspective, this vulnerability aligns with CWE-200: Information Exposure, specifically falling under the sub-category of sensitive information exposure through API endpoints due to broken access control. It also maps directly to MITRE ATT&CK technique T1539: Steal Web Session Cookie, although in this context it involves stealing application-level API keys rather than browser cookies, and T1078: Valid Accounts if the stolen credentials are used to authenticate as legitimate users. The lack of authentication requirement places it firmly within the realm of unauthenticated attacks, highlighting a fundamental gap in the security architecture regarding endpoint protection policies.
Mitigation strategies must prioritize immediate remediation through software updates or configuration changes that enforce strict authorization checks on all API endpoints handling sensitive workspace data. Developers should implement role-based access control to ensure that only authenticated and authorized users can invoke GET /v1/workspaces, ideally restricting this action to administrators with explicit permissions. Furthermore, it is imperative to rotate the exposed browserfabric_api_keys immediately upon discovery of the breach to invalidate any credentials potentially harvested by attackers during the window of exposure. Long-term architectural improvements should include implementing API gateways that enforce authentication and rate limiting, conducting regular security audits focused on access control logic, and adopting a principle of least privilege for all service-to-service communications involving sensitive keys.