Description

OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers to list all workspaces via GET /v1/workspaces. Attackers can read the unmasked browserfabric_api_key in each workspace's settings map, along with workspace ids, slugs, creator emails and member lists.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-10-11T13:17:18.383Z",
  "pubdate": "2026-10-11T13:17:18.383Z",
  "executiveSummary": "OpenAgents Workspace backend, specifically through launcher-v1.0.17, suffers from a critical information disclosure vulnerability. This flaw resides in the /v1/workspaces endpoint, which fails to implement necessary access control mechanisms, allowing any unauthenticated remote attacker to retrieve sensitive workspace metadata.\nThe exposure includes a comprehensive list of all system workspaces, associated identifiers, URL slugs, creator email addresses, and comprehensive member lists. Most critically, the vulnerability leaks the browserfabric_api_key in plain text format within the settings map of each workspace object.\nThe risk implication is severe, as the exposure of sensitive API credentials permits unauthorized actors to pivot into the underlying infrastructure or linked third-party services managed by the Browserfabric platform. No authentication or elevated privileges are required for exploitation, significantly lowering the barrier to entry for malicious actors. The vulnerability effectively exposes the entire organizational hierarchy and individual user identities to external reconnaissance and credential theft, leading to a complete compromise of confidentiality for workspace configurations.",
  "technicalDetails": "The vulnerability is localized to the /v1/workspaces GET request handler within the OpenAgents Workspace backend component, specifically impacting versions up to launcher-v1.0.17. The root cause is a broken access control (BAC) implementation where the API endpoint fails to validate the session state or authentication headers of the incoming HTTP request before processing the query.\nUnder normal operating conditions, an endpoint responsible for returning a list of workspaces should verify that the requester possesses valid administrative or member-level authorization for the requested resources. In this instance, the controller lacks these authorization checks, defaulting to an 'allow-all' policy for unauthenticated traffic.\nThe attack flow is straightforward: an unauthenticated remote attacker sends an HTTP GET request to the target domain's /v1/workspaces URI. The backend controller processes the request without authentication enforcement and proceeds to fetch the complete dataset from the persistent data store (likely a document-oriented or relational database). The resulting JSON payload, which includes internal object metadata, is then serialized and returned in the HTTP response body.\nThe disclosed payload contains highly sensitive configuration structures. Specifically, the 'settings' object within each workspace entry includes the 'browserfabric_api_key' field. By failing to mask this sensitive key during the serialization process, the application inadvertently facilitates credential exfiltration. The inclusion of member lists, slugs, and creator emails provides an attacker with a roadmap for further social engineering or targeted attacks against users identified within the system.\nBecause the vulnerability is reachable over any network path that can communicate with the backend API, the attack surface includes public-facing instances of OpenAgents. An attacker can trivially automate the enumeration of all workspaces by repeatedly polling the endpoint. Post-exploitation, the exposure of the browserfabric_api_key provides the attacker with the ability to authenticate as the workspace owner against Browserfabric services, potentially leading to unauthorized browser automation, session hijacking, or exfiltration of browser-based data processed by the affected workspaces."
}