CVE-2026-123786
Last modified
CVE-2026-123786 is a high-severity vulnerability rated 8.5/10 on the CVSS scale. Agenta before 0.122.5 contains a server-side request forgery vulnerability that allows workspace members with workflow edit rights to redirect workflow invocations by setting arbitrary revision URLs. Attackers can capture the attached secret-resolve Authorization token to read provider secrets from the vault API, or reach internal and cloud metadata addresses..
Description
Agenta before 0.122.5 contains a server-side request forgery vulnerability that allows workspace members with workflow edit rights to redirect workflow invocations by setting arbitrary revision URLs. Attackers can capture the attached secret-resolve Authorization token to read provider secrets from the vault API, or reach internal and cloud metadata addresses.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Agenta-AI | agenta | < 0.122.5 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-123786?
How severe is CVE-2026-123786?
How do I fix CVE-2026-123786?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-12376The Academy LMS WordPress plugin through 3.8.2 does not rest…4.3
- CVE-2026-12378The Appointment Booking Calendar Plugin and Scheduling Plugi…8.1
- CVE-2026-123782ChatWiki before 2.10.0 contains an insecure direct object re…4.3
- CVE-2026-123783Skyvern through 1.0.56 contains a sandbox bypass vulnerabili…8.8
- CVE-2026-123784Fluxbox through 1.3.7 contains an OS command injection vulne…7.8
- CVE-2026-123785Fluxbox through 1.3.7 contains an infinite loop vulnerabilit…5.5
- CVE-2026-12379An Open Redirect vulnerability (CWE-601) exists in the OAuth…6.8
- CVE-2026-1238The SlimStat Analytics plugin for WordPress is vulnerable to…7.2
- CVE-2026-12380Improper neutralization of input during web page generation …6.1
- CVE-2026-12382A flaw was found in the AAP Gateway Envoy proxy configuratio…8.2
- CVE-2026-12383A flaw was found in the Event-Driven Ansible (EDA) server. T…7.5
- CVE-2026-12384Authorization bypass through User-Controlled key vulnerabili…8.8
Are you affected by CVE-2026-123786?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST