OpenAgents Workspace CVE-2026-108739

No special conditions - remote unauthenticated exploitation against any network-reachable OpenAgents Workspace backend through launcher-v1.0.17, by sending a single GET /v1/workspaces request (the endpoint performs no authentication per CWE-306). The only limiting factor is network reachability of the backend: exploitation requires the attacker to reach the HTTP API, so instances bound to localhost, placed behind an authenticating reverse proxy, or otherwise network-segmented are not directly exposed. Severity is amplified where the browserfabric_api_key is populated, since that secret is returned unmasked.

Multiple signals align on genuine confidentiality risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) confirms a network-reachable, low-complexity flaw requiring no authentication (PR:N) and no user interaction - fully consistent with the CWE-306 (Missing Authentication) classification and the description's unauthenticated GET /v1/workspaces endpoint. The 8.7 score is driven entirely by high confidentiality impact (VC:H) with no integrity or availability impact (VI:N/VA:N), which matches an information-disclosure-only bug. No EPSS score and no KEV status were provided in the input, so exploitation probability and active-exploitation status cannot be confirmed from available data; absence of these signals is not evidence of low risk. A VulnCheck advisory plus a public HackMD technical write-up exist, but no explicit POC flag was supplied - treat exploit availability as a technical write-up rather than confirmed weaponized code. The real-world priority is tempered by the product's likely small deployment footprint: this is a high-severity flaw in a niche open-source project, so it is a real must-fix for any organization running OpenAgents Workspace but not a broad fleet-wide emergency. The most severe consequence is leakage of the unmasked browserfabric_api_key, which enables downstream credential abuse against the BrowserFabric service - that secondary blast radius should be weighed above the directory-listing of emails/slugs.

An unauthenticated attacker who can reach the OpenAgents Workspace backend sends a single GET request to /v1/workspaces and receives a JSON listing of every workspace, including each workspace's settings map with the unmasked browserfabric_api_key, plus ids, slugs, creator emails, and member lists. The attacker then reuses the harvested API keys against the BrowserFabric service and uses the email/member data for targeted follow-on attacks. A public HackMD technical write-up documents the flaw, though no confirmed standalone exploit tool was indicated in the input.