Skip to content
SSRF Vulnerabilities in Agenta API Expose Secrets

SSRF Vulnerabilities in Agenta API Expose Secrets

First seen 6 Nov 2026, 22:46 UTC •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 6, 2026 at 22:47 UTC
  • •Two critical SSRF vulnerabilities in Agenta API allow credential leakage.
  • •User-supplied URLs are not properly validated, leading to exploitation.
  • •No patches have been released; the vulnerabilities are under active investigation.

Two vulnerabilities were disclosed in the Agenta API that allow an attacker to exploit user-supplied URLs. The first vulnerability enables a workspace member with EDITOR role to send privileged credentials to an attacker-controlled URL, while the second allows for server-side request forgery (SSRF) to internal metadata targets, leaking sensitive tokens. Both vulnerabilities are present in versions prior to 0.114.3 and can be exploited through improperly validated URLs. The vulnerabilities have been confirmed and are currently being addressed. No patches have been released yet, and the situation is under active investigation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 17h ago How this analysis works

Timeline

2026-11-06
Vulnerabilities disclosed
Agenta disclosed two critical SSRF vulnerabilities affecting the API, allowing credential leakage.
GitHub
2026-11-06
Investigation ongoing
Agenta is actively investigating the vulnerabilities and their potential impact on users.
GitHub

More articles in this cluster (2)

Extracted Entities (7)

1 / 4

Common questions

What versions are affected?
The vulnerabilities affect Agenta API versions prior to 0.114.3.
Are these vulnerabilities being exploited in the wild?
Yes, active exploitation has been confirmed, with attackers leveraging the SSRF vulnerabilities.
What should organizations do now?
Organizations should monitor for updates from Agenta and implement any recommended mitigations as soon as they are available.