Agenta workflow revision URL leaks secret token via SSRF

Summary

Agenta versions before 0.122.5 do not validate workflow revision URLs, which enables server-side request forgery (SSRF). A workspace member with workflow edit rights can capture the authorization token to read secret values or reach internal and cloud metadata addresses.

Affected when

• Workspace member with workflow edit rights

What to do

Update to Agenta 0.122.5 or later. If you run custom workflows on a private network or plain http, after updating set AGENTA_GATEWAYS_INSECURE_EGRESS_ALLOWED=true or add the host to AGENTA_MCP_GATEWAY_HOST_ALLOWLIST.

Products and platforms

• agenta

CVE IDs

• CVE-2026-123786 (opens in a new tab)

Sources

• Advisory: github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab)
• Write-up: github.com (opens in a new tab) · vulncheck.com (opens in a new tab)
• CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-06 15:01 UTC

First seen 2026-11-09 18:10 UTC