CVE-2026-27952: Agenta LLMOps Platform RCE Vulnerability

CVE-2026-27952 Overview

CVE-2026-27952 is a Python sandbox escape vulnerability in Agenta's custom code evaluator that allows authenticated users to achieve arbitrary code execution on the API server. Agenta, an open-source LLMOps platform, used RestrictedPython as a sandboxing mechanism for user-supplied evaluator code but incorrectly whitelisted the numpy package as safe within the sandbox. This misconfiguration enabled attackers to bypass sandbox restrictions and execute arbitrary commands on the underlying server through Python's introspection utilities.

Critical Impact

Authenticated attackers can escape the Python sandbox and achieve full arbitrary code execution on the Agenta API server, potentially compromising the entire self-hosted platform and any connected infrastructure.

Affected Products

• Agenta-API versions prior to 0.48.1
• Agenta self-hosted platform (API server)
• Agenta versions using RestrictedPython sandbox (prior to v0.60)

Discovery Timeline

• 2026-02-26 - CVE CVE-2026-27952 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-27952

Vulnerability Analysis

This vulnerability represents a Code Injection flaw (CWE-94) in Agenta's custom code evaluator component. The vulnerability stems from an insecure allowlist configuration in the RestrictedPython sandbox implementation. While RestrictedPython is designed to execute untrusted Python code in a restricted environment, the Agenta developers incorrectly assumed that the numpy package was safe to include in the sandbox allowlist.

The critical issue is that numpy provides access to Python's introspection capabilities through its internal modules. Specifically, numpy.ma.core.inspect exposes Python's introspection utilities, which include access to sys.modules. This access allows an attacker to traverse the module hierarchy and reach unfiltered system-level functionality such as os.system, effectively breaking out of the sandbox entirely.

This vulnerability affects only the self-hosted Agenta platform where the API server processes custom evaluator code. The Agenta SDK used as a standalone Python library is not affected. The custom code evaluator runs server-side within the API process, meaning successful exploitation grants code execution with the privileges of the API server process.

Root Cause

The root cause of this vulnerability is an improper allowlist configuration in the RestrictedPython sandbox. The developers assumed that numpy, being a numerical computing library, would be safe to expose to user-supplied code. However, they failed to account for the fact that numpy internally imports and exposes Python's inspect module, which provides powerful introspection capabilities that can be abused to escape the sandbox.

The numpy.ma.core submodule specifically imports Python's inspect module, making it accessible through the numpy namespace. From there, attackers can access sys.modules and subsequently load dangerous modules like os, subprocess, or socket that should have been blocked by the sandbox.

Attack Vector

The attack is network-accessible and requires only low-privilege authentication to the Agenta platform. An authenticated user can submit malicious evaluator code through the API that leverages the numpy allowlist exception to escape the sandbox. The attack chain involves:

1. Accessing numpy.ma.core.inspect from within the sandbox
2. Using introspection to reach sys.modules
3. Loading system modules like os or subprocess
4. Executing arbitrary system commands with the API server's privileges

The exploitation path through numpy.ma.core.inspect provides access to Python's introspection utilities — including sys.modules — thereby providing access to unfiltered system-level functionality like os.system. See the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-27952

Indicators of Compromise

• Unusual process spawning from the Agenta API server process
• API server executing shell commands or accessing sensitive system resources
• Evaluator code submissions containing references to numpy.ma.core, inspect, sys.modules, or os.system
• Unexpected network connections originating from the API server

Detection Strategies

• Monitor evaluator code submissions for patterns involving numpy.ma.core.inspect or similar introspection paths
• Implement application-level logging for all custom evaluator code execution
• Deploy endpoint detection solutions to monitor for anomalous process behavior from the API server
• Review API access logs for unusual patterns of evaluator submissions from specific users

Monitoring Recommendations

• Configure alerting for any subprocess execution from the Agenta API process
• Implement code scanning on evaluator submissions to detect sandbox escape patterns
• Monitor file system access patterns from the API server for unauthorized reads or writes
• Enable audit logging for system calls made by the API server process

How to Mitigate CVE-2026-27952

Immediate Actions Required

• Upgrade Agenta-API to version 0.48.1 or later immediately
• Consider upgrading to version 0.60 or later where the RestrictedPython sandbox was replaced entirely
• Audit recent evaluator submissions for potential exploitation attempts
• Review system logs for indicators of compromise

Patch Information

The vulnerability is fixed in Agenta version 0.48.1 by removing numpy from the sandbox allowlist. In later versions (v0.60+), the RestrictedPython sandbox was removed entirely and replaced with a different execution model that provides stronger isolation guarantees. Organizations should prioritize upgrading to the latest stable release. For more details, see the GitHub Security Advisory.

Workarounds

• If immediate patching is not possible, disable the custom code evaluator feature until the upgrade can be performed
• Implement network segmentation to limit the blast radius of potential exploitation
• Apply strict authentication controls and limit which users can submit custom evaluator code
• Consider deploying the API server in an isolated container environment with minimal privileges

# Verify Agenta version and upgrade if necessary
# Check current version
pip show agenta | grep Version

# Upgrade to patched version
pip install --upgrade agenta>=0.48.1

# For production deployments, use the latest stable release
pip install --upgrade agenta>=0.60.0