CVE-2026-108711 Details

A vulnerability exists in Plastic Labs Honcho versions through 3.3.0, allowing peer- or session-scoped API key holders to access workspace data. This issue arises because the 'get_or_create_workspace' function only verifies the workspace claim, neglecting to check session or peer-specific claims. As a result, attackers can exploit this by sending their parent workspace name to the 'POST /v3/workspaces' endpoint, thereby retrieving sensitive workspace metadata and configuration, including custom instructions, which should only be accessible with workspace or admin-level keys.

The vulnerability can be fixed by adding checks for the peer and session claims in the workspace API route, ensuring that these narrower scopes do not have access to workspace-level data. This adjustment should be accompanied by regression tests to verify the effectiveness of the fix.