CVE-2026-108739: OpenAgents Workspace through launcher-v1.0.17 Unauthenticated Credential Exposure via /v1/workspaces
OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers to list all workspaces via GET /v1/workspaces. Attackers can read the unmasked browserfabricapikey in each workspace's settings map, along with workspace ids, slugs, creator emails and member lists.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker able to reach the Workspace backend can request GET /v1/workspaces. No credentials or user interaction are required.
What information can be exposed?
The endpoint can disclose all workspace records, including workspace IDs, slugs, creator email addresses, member lists, and the unmasked browserfabric_api_key in each workspace's settings map.
Are deployments affected without a special configuration?
The affected endpoint is described as returning workspace listings without authentication, and the API key is exposed when present in a workspace settings map. The provided data does not identify a configuration requirement that would otherwise protect the endpoint.
How can I determine whether my instance is exposed?
From an unauthenticated client, check whether GET /v1/workspaces is reachable and returns workspace data. An affected response may include a settings map containing an unmasked browserfabric_api_key.