Description
OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers to list all workspaces via GET /v1/workspaces. Attackers can read the unmasked browserfabric_api_key in each workspace's settings map, along with workspace ids, slugs, creator emails and member lists.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
openagents-org OpenAgents
Default version status: unaffected
0 to ≤ launcher-v1.0.17affected
pkg:github/openagents-org/openagentsReferences
- https://hackmd.io/@haind/openagents-workspace-list-browserfabric-key-disclosure ↗
- https://github.com/openagents-org/openagents/blob/0824907096d4039d86dfc96b81f9eebf31a77ae7/workspace/backend/app/routers/workspaces.py#L135-L177 ↗
- https://github.com/openagents-org/openagents/blob/0824907096d4039d86dfc96b81f9eebf31a77ae7/workspace/backend/app/routers/workspaces.py#L326-L349 ↗
- https://github.com/openagents-org/openagents ↗
- https://www.vulncheck.com/advisories/openagents-workspace-through-launcher-1.0.17-unauthenticated-credential-exposure-via-v1-workspaces ↗