CVE-2026-123786

Agenta versions before 0.122.5 are vulnerable to a server-side request forgery (SSRF) vulnerability. Workspace members with workflow edit rights can exploit this by setting arbitrary revision URLs to redirect workflow invocations. This flaw allows attackers to capture the secret-resolve Authoriza...

CVE-2026-123786 Agenta before 0.122.5 SSRF via Workflow Revision URL Leaks Secret Token

Agenta before 0.122.5 contains a server-side request forgery vulnerability that allows workspace members with workflow edit rights to redirect workflow invocations by setting arbitrary revision URLs. Attackers can capture the attached secret-resolve Authorization token to read provider secrets fr...