CVE-2026-108739: OpenAgents Workspace Information Disclosure

CVE-2026-108739 Overview

CVE-2026-108739 is an information disclosure vulnerability in the OpenAgents Workspace backend through launcher-v1.0.17. The flaw allows unauthenticated attackers to enumerate every workspace by sending a GET request to /v1/workspaces. The response includes unmasked browserfabric_api_key values stored in each workspace's settings map, along with workspace identifiers, slugs, creator email addresses, and member lists. The root cause is a missing authentication check on a listing endpoint that returns sensitive configuration data [CWE-306]. Attackers can harvest API keys and user data without credentials, enabling downstream abuse of integrated services and targeted phishing against identified workspace members.

Critical Impact
Unauthenticated network attackers can retrieve browserfabric_api_key credentials and account metadata for every workspace in a vulnerable OpenAgents deployment.

Affected Products

OpenAgents Workspace backend through launcher-v1.0.17
/v1/workspaces listing endpoint in workspace/backend/app/routers/workspaces.py
Deployments relying on BrowserFabric API key integration within OpenAgents

Discovery Timeline

2026-10-11 - CVE-2026-108739 published to the National Vulnerability Database
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-108739

Vulnerability Analysis

The OpenAgents Workspace backend exposes a REST endpoint at GET /v1/workspaces that returns a list of all workspaces present in the deployment. The handler does not validate caller identity or scope results to the requesting user. Any unauthenticated client reachable over the network receives the full dataset. Each workspace object includes a settings map that embeds the browserfabric_api_key in cleartext. The response also contains workspace identifiers, slugs, creator email addresses, and member lists. Attackers can replay the leaked API key against BrowserFabric services and use the harvested email addresses for targeted social engineering.

Root Cause

The vulnerability stems from Missing Authentication for a Critical Function [CWE-306]. The listing route in workspace/backend/app/routers/workspaces.py lacks an authentication dependency and lacks server-side field redaction. Secrets stored under the workspace settings map are serialized directly to API consumers. Technical references for the vulnerable code paths are available in the GitHub OpenAgents repository and the specific handler at workspaces.py L135-L177.

Attack Vector

Exploitation requires only network reach to the Workspace backend. An attacker issues an unauthenticated HTTP GET request to /v1/workspaces and parses the JSON response for the browserfabric_api_key field inside each workspace's settings object. No user interaction, prior access, or privilege is required. Additional detail is available in the HackMD disclosure writeup and the VulnCheck advisory.

Detection Methods for CVE-2026-108739

Indicators of Compromise

Unauthenticated HTTP GET requests to /v1/workspaces from unexpected source IP addresses
Spikes in response size or outbound bandwidth from the Workspace backend to external clients
BrowserFabric API usage originating from IP addresses or user agents not associated with normal operations
Phishing attempts referencing exact workspace slugs, member emails, or creator identities

Detection Strategies

Instrument the Workspace backend to log every call to /v1/workspaces with source IP, user agent, and authentication state
Alert on any request to /v1/workspaces lacking a session cookie or bearer token
Correlate access log entries with BrowserFabric API key usage to detect replay from leaked credentials
Deploy web application firewall rules that require authentication headers on the workspace listing route

Monitoring Recommendations

Forward Workspace backend access logs and reverse-proxy logs to a centralized SIEM for retention and correlation
Rotate and monitor browserfabric_api_key values and track their usage patterns for anomalies
Audit outbound BrowserFabric API calls for unfamiliar source addresses or off-hours activity
Review historical access logs for prior unauthenticated hits on /v1/workspaces to scope potential exposure

How to Mitigate CVE-2026-108739

Immediate Actions Required

Restrict network access to the Workspace backend using an authenticated reverse proxy, VPN, or allowlist until a patched release is deployed
Rotate every browserfabric_api_key present in workspace settings and invalidate the previous values at the BrowserFabric provider
Review access logs for prior unauthenticated requests to /v1/workspaces and treat exposed keys as compromised
Notify workspace creators and members whose email addresses were enumerable so they can watch for targeted phishing

Patch Information

At the time of publication, OpenAgents maintainers had not released a fixed version beyond launcher-v1.0.17. Monitor the OpenAgents GitHub repository for updated releases that add authentication to the /v1/workspaces route and remove secrets from serialized responses. The affected handler is referenced at workspaces.py L326-L349.

Workarounds

Place the Workspace backend behind an authenticating gateway that blocks unauthenticated requests to /v1/workspaces
Patch the route locally to require a valid session and to redact the browserfabric_api_key and member list fields from responses
Scope the listing endpoint to return only workspaces where the authenticated caller is a member or creator
Store BrowserFabric credentials in a secrets manager and inject them at runtime rather than persisting them in workspace settings

bash

# Example reverse-proxy rule blocking unauthenticated access to the vulnerable route
# nginx snippet - require Authorization header for /v1/workspaces
location = /v1/workspaces {
    if ($http_authorization = "") {
        return 401;
    }
    proxy_pass http://openagents_backend;
}