CVE-2026-123786 in Agenta
Summary
by MITRE • 11/06/2026
Agenta before 0.122.5 contains a server-side request forgery vulnerability that allows workspace members with workflow edit rights to redirect workflow invocations by setting arbitrary revision URLs. Attackers can capture the attached secret-resolve Authorization token to read provider secrets from the vault API, or reach internal and cloud metadata addresses.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/06/2026
Agenta versions prior to 0.122.5 are susceptible to a server-side request forgery vulnerability that stems from insufficient validation of user-supplied input within workflow configuration parameters. This flaw specifically affects workspace members who possess edit rights for workflows, allowing them to manipulate the revision URLs used during workflow invocations. By setting arbitrary or maliciously crafted revision URLs, an attacker can force the Agenta application server to initiate HTTP requests to destinations controlled by the adversary rather than legitimate internal services. This misdirection exploits the trust relationship between the application and its backend infrastructure, effectively turning the server into a proxy for unauthorized network access.
The operational impact of this vulnerability is significant due to the potential exposure of sensitive credentials and internal system information. When the workflow engine processes the manipulated revision URL, it may attach an Authorization token designed for secret resolution purposes. An attacker leveraging this flaw can intercept or capture these tokens as they are transmitted during the forged request process. With access to these secrets, the adversary gains the ability to read provider secrets stored in the vault API, compromising the confidentiality of critical authentication credentials and service keys. This level of access allows for further exploitation within the environment, potentially leading to full account compromise or unauthorized data exfiltration.
Furthermore, this vulnerability facilitates network reconnaissance and lateral movement by enabling access to internal services and cloud metadata endpoints that are typically isolated from external networks. By directing requests toward local host addresses or cloud provider metadata service URLs, an attacker can retrieve instance identity documents, temporary security credentials, and other sensitive configuration details. This capability undermines the principle of least privilege and network segmentation strategies, as it allows a user with limited application-level permissions to interact directly with backend infrastructure components that should remain inaccessible from the application layer.
From a classification perspective, this issue aligns with CWE-918 Server-Side Request Forgery (SSRF), which describes flaws where an attacker causes the server to make requests to unintended destinations. Additionally, the exploitation technique maps to MITRE ATT&CK techniques such as T1557 Adversary-in-the-Middle for credential interception and potentially T1046 Network Service Discovery if used for mapping internal services. The vulnerability highlights a critical gap in input validation regarding URL schemes and hostnames within workflow definitions.
To mitigate this risk, organizations running Agenta versions earlier than 0.122.5 should upgrade to the latest patched version immediately. In environments where upgrading is not yet feasible, administrators can implement network-level controls such as firewall rules or reverse proxy configurations to block outbound requests from the application server to internal IP ranges and cloud metadata endpoints unless explicitly required for business logic. Additionally, restricting workflow edit permissions to only those users who absolutely require them reduces the attack surface by limiting the number of individuals capable of triggering the flawed code path. Continuous monitoring of outbound network traffic originating from Agenta servers can also aid in detecting attempts to exploit this vulnerability through anomalous request patterns or connections to known malicious domains.