openagents-org openagents up to 0.8.19/0.9.3.post20 http.py test_default_model base_url server-side request forgery

Summaryinfo

A vulnerability, which was classified as problematic, was found in openagents-org openagents up to 0.8.19/0.9.3.post20. The affected element is the function test_default_model of the file sdk/src/openagents/sdk/transports/http.py. Executing a manipulation of the argument base_url can lead to server-side request forgery. The identification of this vulnerability is CVE-2026-86237. The attack may be launched remotely. Furthermore, there is an exploit available. Endpoint and both sinks unchanged since filing; only the file moved (e277dd1a). Maintainer closed as inapplicable yet the identical unguarded code still ships in 0.9.3.post20. Sibling admin endpoints do call the shipped-but-unused-by-this-handler _require_admin().

Detailsinfo

A vulnerability classified as problematic was found in openagents-org openagents up to 0.8.19/0.9.3.post20. This vulnerability affects the function test_default_model of the file sdk/src/openagents/sdk/transports/http.py. The manipulation of the argument base_url with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality.

The advisory is available at github.com. This vulnerability was named CVE-2026-86237. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details and also a public exploit are known.

It is possible to download the exploit at github.com. It is declared as proof-of-concept. Endpoint and both sinks unchanged since filing; only the file moved (e277dd1a). Maintainer closed as inapplicable yet the identical unguarded code still ships in 0.9.3.post20. Sibling admin endpoints do call the shipped-but-unused-by-this-handler _require_admin().

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• openagents-org

Name

• openagents

Version

• 0.8.0
• 0.8.1
• 0.8.2
• 0.8.3
• 0.8.4
• 0.8.5
• 0.8.6
• 0.8.7
• 0.8.8
• 0.8.9
• 0.8.10
• 0.8.11
• 0.8.12
• 0.8.13
• 0.8.14
• 0.8.15
• 0.8.16
• 0.8.17
• 0.8.18
• 0.8.19
• 0.9.3.post20

Website

• Product: https://github.com/openagents-org/openagents/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #898788: openagents-org OpenAgents v0.8.19 SSRF (by yangzhongjie)

Duplicate

• Submit #XXXXXX: Xxxxxxxxxx-xxx Xxxxxxxxxx Xx.x.xx Xxxx (by yangzhongjie)

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion