Threats affecting pkg:github/agenta

CVE-2026-123786 is a server-side request forgery (SSRF) vulnerability in Agenta-AI's agenta product versions before 0.122.5. It allows workspace members with workflow edit permissions to redirect workflow invocations by setting arbitrary revision URLs. This can lead to unauthorized access to internal resources and secrets by capturing the Authorization token used for secret resolution. The vulnerability is fixed in version 0.122.5.