CVE-2026-108739: Missing Authentication for Critical Function in openagents-org OpenAgents

CVE-2026-108739 is a missing authentication vulnerability in the OpenAgents Workspace backend (launcher-v1.0.17) that permits unauthenticated attackers to retrieve a list of all workspaces through the GET /v1/workspaces endpoint. This endpoint returns sensitive data such as unmasked API keys (browserfabric_api_key), workspace identifiers, slugs, creator email addresses, and member lists. The vulnerability is rated high severity with a CVSS 4.0 base score of 8.7, indicating network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

An attacker can obtain sensitive workspace information and unmasked API keys without authentication, potentially leading to unauthorized access or further exploitation of the OpenAgents environment. Disclosure of API keys and user data compromises confidentiality and could facilitate additional attacks or data breaches.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /v1/workspaces endpoint and implement authentication controls to prevent unauthenticated access. Monitor for updates from the vendor regarding official patches or mitigations.