CVE-2026-108711

Plastic Labs Honcho versions through 3.3.0 are vulnerable to an incorrect authorization flaw (CWE-863) via the POST /v3/workspaces endpoint. The root cause is that the get_or_create_workspace function only validates the workspace claim, allowing API key holders with peer- or session-scoped access...

CVE-2026-108711 Plastic Labs Honcho through 3.3.0 Incorrect Authorization via POST /v3/workspaces

Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerability that allows peer- or session-scoped API key holders to read workspace data because getorcreateworkspace checks only the workspace claim. Attackers can submit their parent workspace name to the POST /v3/workspaces...

EUVD-2026-96985

Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerability that allows peer- or session-scoped API key holders to read workspace data because getorcreateworkspace checks only the workspace claim. Attackers can submit their parent workspace name to the POST /v3/workspaces...