CVE-2026-123786

Agenta workflow requests can leak credentials or reach internal services

Agenta AI · Agenta workflow and evaluator service

First documented disclosure · Review checkpoint

Summary

Workflow editors can redirect credential-bearing service requests.

Severity and exploitation evidence

High · 8.4/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed public sources describe the vulnerability and its conditions. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The invocation layer forwarded a credential to workflow revision destinations chosen by editors.

Conditions required

A workspace member needs workflow-editing privileges.

Potential impact

A recipient could obtain a service credential or use the server’s access to reach private resources.

Affected versions and configurations

Through 0.122.4.

Fix and mitigation status

0.122.5.

Practical next steps

Upgrade to 0.122.5 and review workflow destinations and service credentials.

Operating lesson

Bind service credentials to the intended destination and purpose.

Evidence and limits

VulnCheck groups two October 12 maintainer advisories under one CVE. The October 11 change applied a destination policy and narrowed the invocation credential.

Sources