37 matches found
CVE-2026-108739
OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers to list all workspaces via GET /v1/workspaces. Attackers can read the unmasked browserfabricapikey in each workspace's settings map, along with workspace id...
EUVD-2026-96905
OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers to list all workspaces via GET /v1/workspaces. Attackers can read the unmasked browserfabricapikey in each workspace's settings map, along with workspace id...
CVE-2026-108739
OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers to list all workspaces via GET /v1/workspaces. Attackers can read the unmasked browserfabricapikey in each workspace's settings map, along with workspace id...
CVE-2026-108739 OpenAgents Workspace through launcher-v1.0.17 Unauthenticated Credential Exposure via /v1/workspaces
OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers to list all workspaces via GET /v1/workspaces. Attackers can read the unmasked browserfabricapikey in each workspace's settings map, along with workspace id...
CVE-2026-108739
The OpenAgents Workspace backend (via launcher-v1.0.17 ) is vulnerable to an information disclosure vulnerability due to missing authentication for critical functions (CWE-306 ). An unauthenticated attacker can perform a GET request to the /v1/workspaces endpoint to list all workspaces. This expo...
CVE-2026-108739 OpenAgents Workspace through launcher-v1.0.17 Unauthenticated Credential Exposure via /v1/workspaces
OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers to list all workspaces via GET /v1/workspaces. Attackers can read the unmasked browserfabricapikey in each workspace's settings map, along with workspace id...
CVE-2026-108739 OpenAgents Workspace through launcher-v1.0.17 Unauthenticated Credential Exposure via /v1/workspaces
OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers to list all workspaces via GET /v1/workspaces. Attackers can read the unmasked browserfabricapikey in each workspace's settings map, along with workspace id...
PT-2026-110142
Name of the Vulnerable Software and Affected Versions OpenAgents Workspace backend versions prior to 1.0.18 Description An information disclosure issue exists that allows unauthenticated attackers to list all workspaces. By accessing the 'GET /v1/workspaces' endpoint, attackers can retrieve...
CVE-2026-108739: Missing Authentication for Critical Function
OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers to list all workspaces via GET /v1/workspaces. Attackers can read the unmasked browserfabricapikey in each workspace's settings map, along with workspace id...
openagents-org openagents Authorization Issue Vulnerability
openagents-org has an authorization issue. This vulnerability stems from the lack of authentication for the GET /v1/workspaces interface, allowing unauthenticated attackers to list all workspaces. This may lead to the reading of sensitive information such as the unmasked browserfabricapikey, as...
CVE-2026-86237
A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20. Impacted is the function testdefaultmodel of the file sdk/src/openagents/sdk/transports/http.py. Performing a manipulation of the argument baseurl results in server-side request forgery. The attack may be initiated...
CVE-2026-86237 openagents-org openagents http.py test_default_model server-side request forgery
A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20. Impacted is the function testdefaultmodel of the file sdk/src/openagents/sdk/transports/http.py. Performing a manipulation of the argument baseurl results in server-side request forgery. The attack may be initiated...
EUVD-2026-72185
A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20. Impacted is the function testdefaultmodel of the file sdk/src/openagents/sdk/transports/http.py. Performing a manipulation of the argument baseurl results in server-side request forgery. The attack may be initiated...
CVE-2026-86237
A server-side request forgery (SSRF) vulnerability affects the openagents-org/openagents Python SDK in versions up to 0.8.19 / 0.9.3.post20 . The vulnerable function is test_default_model in sdk/src/openagents/sdk/transports/http.py, where an unvalidated base_url argument allows a remote, unauthe...
CVE-2026-86237 openagents-org openagents http.py test_default_model server-side request forgery
A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20. Impacted is the function testdefaultmodel of the file sdk/src/openagents/sdk/transports/http.py. Performing a manipulation of the argument baseurl results in server-side request forgery. The attack may be initiated...
CVE-2026-86237
A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20. Impacted is the function testdefaultmodel of the file sdk/src/openagents/sdk/transports/http.py. Performing a manipulation of the argument baseurl results in server-side request forgery. The attack may be initiated...
CVE-2026-86237 openagents-org openagents http.py test_default_model server-side request forgery
A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20. Impacted is the function testdefaultmodel of the file sdk/src/openagents/sdk/transports/http.py. Performing a manipulation of the argument baseurl results in server-side request forgery. The attack may be initiated...
CVE-2026-86237: Server-Side Request Forgery (SSRF)
A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20. Impacted is the function testdefaultmodel of the file sdk/src/openagents/sdk/transports/http.py. Performing a manipulation of the argument baseurl results in server-side request forgery. The attack may be initiated...
PT-2026-86583
A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20. Impacted is the function test default model of the file sdk/src/openagents/sdk/transports/http.py. Performing a manipulation of the argument base url results in server-side request forgery. The attack may be initiat...
