CVE-2026-27961: Agenta SSTI Vulnerability

CVE-2026-27961 Overview

A Server-Side Template Injection (SSTI) vulnerability has been identified in Agenta, an open-source LLMOps platform. The vulnerability exists in versions prior to 0.86.8 within Agenta's API server evaluator template rendering functionality. Although the vulnerable code resides in the SDK package, it is executed server-side within the API process when running evaluators. This vulnerability does not affect standalone SDK usage — it only impacts self-hosted or managed Agenta platform deployments.

Critical Impact
This SSTI vulnerability allows authenticated attackers to execute arbitrary code on the server, potentially leading to complete system compromise, data exfiltration, and lateral movement within the network.

Affected Products

Agenta LLMOps Platform versions prior to 0.86.8
Self-hosted Agenta deployments
Managed Agenta platform deployments

Discovery Timeline

2026-02-26 - CVE CVE-2026-27961 published to NVD
2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-27961

Vulnerability Analysis

This vulnerability is classified under CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine). Server-Side Template Injection occurs when user-controllable input is embedded into a template engine in an unsafe manner, allowing attackers to inject template directives that execute arbitrary code on the server.

In the context of Agenta's LLMOps platform, the vulnerability manifests within the API server's evaluator template rendering process. When users create or modify evaluators, the template input is processed server-side without adequate sanitization. An attacker with authenticated access to the platform could craft malicious template syntax that, when processed by the template engine, executes arbitrary Python code with the privileges of the API server process.

The attack surface is limited to authenticated users on self-hosted or managed Agenta deployments. Standalone SDK usage is not affected because the vulnerable code path is only executed within the API server context.

Root Cause

The root cause stems from improper neutralization of special elements within the template rendering logic. The evaluator functionality accepts user-provided template content that is passed directly to the template engine without sufficient input validation or sandboxing. Template engines in Python (such as Jinja2) can execute arbitrary code if configured insecurely or if user input is not properly escaped.

Attack Vector

The attack vector is network-based, requiring authenticated access to the Agenta platform. An attacker must have valid credentials and access to the evaluator functionality to exploit this vulnerability. The attacker would craft a malicious template payload containing template injection syntax specific to the underlying template engine. When the evaluator processes this template, the injected code executes server-side.

The vulnerability exploitation typically follows this pattern: the attacker submits a specially crafted evaluator template through the API, the template engine processes the input without proper sanitization, and the injected code executes within the context of the API server process. This can lead to unauthorized access to sensitive data, modification of system configurations, or execution of system commands.

For detailed technical information about the vulnerability mechanism, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-27961

Indicators of Compromise

Unusual evaluator template content containing template injection syntax patterns such as {{, {%, or ${
Unexpected system command execution originating from the Agenta API server process
Anomalous outbound network connections from the API server to unknown destinations
Modified or newly created files in the server environment not associated with normal operations

Detection Strategies

Implement input validation logging to capture and alert on suspicious template patterns in evaluator submissions
Monitor API server process behavior for child process spawning or unexpected system calls
Deploy web application firewalls (WAF) with rules to detect common SSTI payloads
Enable audit logging for all evaluator creation and modification operations

Monitoring Recommendations

Establish baseline behavior for the Agenta API server and alert on deviations
Monitor network traffic from the API server for unusual egress patterns
Implement file integrity monitoring on critical system directories
Review authentication logs for unauthorized access attempts to evaluator endpoints

How to Mitigate CVE-2026-27961

Immediate Actions Required

Upgrade Agenta to version 0.86.8 or later immediately
Audit existing evaluator templates for suspicious or malicious content
Review access logs for potential exploitation attempts prior to patching
Restrict access to evaluator functionality to trusted users only until patching is complete

Patch Information

Agenta version 0.86.8 contains the fix for this vulnerability. Organizations running self-hosted or managed Agenta deployments should upgrade to this version or later as soon as possible. The patch addresses the improper neutralization of special elements in the template rendering process.

For additional details, see the GitHub Security Advisory.

Workarounds

Restrict network access to the Agenta API server to trusted IP ranges only
Implement additional input validation at the network perimeter using a WAF
Disable or restrict access to the evaluator functionality until patching is feasible
Run the Agenta API server in a sandboxed or containerized environment with minimal privileges

bash

# Configuration example - Restrict evaluator access via reverse proxy
# Add to nginx configuration to limit evaluator endpoint access
location /api/evaluators {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://agenta-api:8000;
}