Threat database

OpenAgents Workspace backend version 0 contains an information disclosure vulnerability that allows unauthenticated attackers to list all workspaces via an API endpoint. This exposure reveals sensitive data including unmasked API keys, workspace IDs, slugs, creator emails, and member lists. The vulnerability has a high severity score of 8.7.

CVE-2026-86237 is a server-side request forgery (SSRF) vulnerability in the openagents-org openagents project affecting versions 0.8.0 through 0.8.19 and 0.9.3.post20. The vulnerability exists in the test_default_model function in sdk/src/openagents/sdk/transports/http.py, where manipulation of the base_url argument can lead to SSRF. The vulnerability can be exploited remotely without authentication. Although the maintainer has closed the issue as inapplicable, the vulnerable code remains in version 0.9.3.post20. The CVSS 4.0 score is 6.9, indicating a medium severity level.