Description

Agenta before 0.122.5 contains a server-side request forgery vulnerability that allows workspace members with workflow edit rights to redirect workflow invocations by setting arbitrary revision URLs. Attackers can capture the attached secret-resolve Authorization token to read provider secrets from the vault API, or reach internal and cloud metadata addresses.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-11-06T15:17:21.643Z",
  "pubdate": "2026-11-06T15:17:21.643Z",
  "executiveSummary": "Agenta versions prior to 0.122.5 are susceptible to a critical Server-Side Request Forgery (SSRF) vulnerability. This flaw resides in the workflow invocation mechanism, permitting authenticated workspace members with workflow edit privileges to manipulate revision URLs. By injecting arbitrary URLs into the revision field, an attacker can coerce the Agenta server into executing outbound requests to attacker-controlled endpoints or sensitive internal resources. The primary security risk involves the exfiltration of sensitive 'secret-resolve' Authorization tokens. Upon capturing these tokens, an attacker can impersonate the service to query the vault API, effectively bypassing access controls to retrieve stored provider secrets. Furthermore, the vulnerability enables the traversal of internal network boundaries, allowing potential access to cloud metadata services or other internal infrastructure reachable from the Agenta server's environment. This represents a significant risk to the integrity and confidentiality of the Agenta deployment, as it provides a pathway to escalate privileges and access unauthorized internal or cloud-based credentials.",
  "technicalDetails": "The vulnerability originates from a lack of input validation and sanitization on the workflow revision URL parameter within the Agenta orchestration logic. In affected versions (pre-0.122.5), the application fails to restrict the destination of outgoing HTTP requests initiated by the server during workflow invocations. Users possessing 'workflow edit' permissions can modify the revision URL endpoint, which the Agenta backend subsequently utilizes to fetch or validate workflow resources.\nThe attack flow commences when a workspace member with sufficient privileges alters the revision URL field to point to an attacker-controlled listener. When the Agenta platform initiates the invocation, it performs a server-side request to the malicious URL. During this process, the application inadvertently includes an Authorization header containing a sensitive 'secret-resolve' token. The attacker’s listener captures this request, extracting the token from the headers. With this captured token, the attacker can then make authenticated requests to the platform's internal vault API. By substituting the intercepted token, the attacker effectively acts with the permissions of the Agenta service, allowing them to read sensitive provider secrets intended for secure storage. In scenarios where the Agenta instance resides within a cloud-provider environment, the attacker can alternatively pivot this SSRF to target local metadata service endpoints (e.g., 169.254.169.254), potentially harvesting cloud instance identities or temporary security credentials.\nThe scope of this vulnerability is inherently linked to the trust model of the internal network; since the Agenta server is authorized to resolve and utilize these secrets, any process that tricks the server into performing outbound requests with those credentials creates a direct escalation path. The exploitation requirement is limited to active workspace membership with edit rights, bypassing the need for administrative access. Post-exploitation, the impact is severe, as it facilitates the full disclosure of third-party API keys, database credentials, and internal environment configurations stored within the vaulted secret management system."
}