CVE-2026-108739 Details

A vulnerability in the OpenAgents Workspace backend, specifically in version launcher-v1.0.17, allows unauthenticated attackers to access sensitive information by listing all workspaces through the GET /v1/workspaces endpoint. The response includes unmasked browserfabric_api_keys from each workspace's settings, along with workspace IDs, slugs, creator emails, and member lists. This issue arises because the list route lacks authentication and access checks, leaving sensitive data exposed to any network caller.

The vulnerability can be addressed by adding authentication and access checks to the GET /v1/workspaces route, ensuring that only authorized users can access workspace information. Additionally, secret values like the browserfabric API key should be stored in a secure manner that prevents accidental exposure through the workspace settings.