Information Disclosure Vulnerability in OpenAgents Workspace by OpenAgents
CVE-2026-108739

8.7HIGH

Key Information:

Vendor

Openagents-org

Status
Openagents
Vendor
CVE Published:
11 October 2026

What is CVE-2026-108739?

The backend of OpenAgents Workspace version launcher-v1.0.17 is susceptible to an information disclosure flaw that allows unauthenticated attackers to enumerate all workspaces. By triggering a GET request to the /v1/workspaces endpoint, attackers can gain access to sensitive data, including unmasked browserfabric_api_keys, workspace IDs, slugs, creator emails, and member lists. This vulnerability poses a significant risk as it can facilitate unauthorized access to private information and compromise the integrity of workspace security.

Affected Version(s)

OpenAgents 0

References

https://hackmd.io/@haind/openagents-workspace-list-browse...
third-party-advisory
https://github.com/openagents-org/openagents/blob/0824907...
technical-description
https://github.com/openagents-org/openagents/blob/0824907...
technical-description

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.