Openagents
Approved changes feed: RSS · Atom
cpe:2.3:a:openagents-org:openagents:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Openagents Org (41c812af-ec25-58c5-9fd2-00ce563c73c0) |
|---|---|
| Product | Openagents (2dd3c395-afaf-5a0c-a6e7-ec9bd77fccef) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-108739 |
vulnerable | 2026-11-03 10:18:02.104029 |
OpenAgents Workspace through launcher-v1.0.17 Unauthenticated Credential Exposure via /v1/workspaces
HIGH (7.5)
OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers to list all workspaces via GET /v1/workspaces. Attackers can read the unmasked browserfabric_api_key in each workspace's settings map, along with workspace ids, slugs, creator emails and member lists.
Published: 2026-10-11T12:19:44.257Z
Updated: 2026-10-14T13:28:40.918Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-86237 |
vulnerable | 2026-09-16 04:32:58.961603 |
openagents-org openagents http.py test_default_model server-side request forgery
MEDIUM (5.3)
A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20. Impacted is the function test_default_model of the file sdk/src/openagents/sdk/transports/http.py. Performing a manipulation of the argument base_url results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. Endpoint and both sinks unchanged since filing; only the file moved (e277dd1a). Maintainer closed as inapplicable yet the identical unguarded code still ships in 0.9.3.post20. Sibling admin endpoints do call the shipped-but-unused-by-this-handler _require_admin().
Published: 2026-09-07T00:15:08.485Z
Updated: 2026-09-08T18:10:28.355Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.