Plastic Labs Honcho EUVD-2026-96985

Exploitation requires the attacker to already possess a valid peer- or session-scoped Honcho API key (a lower-privilege token) and to know the name of the parent workspace, which they then submit to the POST /v3/workspaces endpoint; get_or_create_workspace's check of only the workspace claim is the specific flaw. Limiting factors: a valid scoped credential is mandatory (no unauthenticated access per PR:L), no user interaction is needed, exposure is read-only disclosure of workspace metadata and custom_instructions with no write/integrity or availability impact, and the issue affects Honcho versions up to and including 3.3.0.

This is a medium-severity (CVSS 4.0 base 5.3) incorrect-authorization flaw (CWE-863) in Plastic Labs Honcho through 3.3.0. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation that requires an already-authenticated low-privilege actor - specifically a peer- or session-scoped API key holder (PR:L), not an unauthenticated attacker. Impact is confidentiality-only and rated Low (VC:L, with VI:N/VA:N): no data modification or availability loss, and no scope change to other systems (SC/SI/SA:N). No EPSS score, CISA KEV listing, or POC flag was supplied in the intelligence set, and no SSVC decision data was provided, so automated-exploitation likelihood cannot be quantified from the input. The practical risk is a real but bounded privilege/authorization boundary violation: a tenant or user who legitimately holds a narrowly-scoped key can read higher-privileged workspace configuration (including custom_instructions) belonging to the parent workspace. This is a genuine multi-tenant isolation issue worth prioritizing in environments where scoped keys are distributed to less-trusted parties, but it is not a high-urgency RCE/takeover - it is a high-plausibility, low-impact information disclosure rather than a high-CVSS-but-overblown issue. Confidence that this is authenticated-only rests on the PR:L metric in the supplied vector.

A multi-tenant Honcho deployment issues peer- or session-scoped API keys to individual clients or end-user integrations. A holder of such a scoped key sends a POST /v3/workspaces request naming the parent workspace, and because get_or_create_workspace validates only the workspace claim, the API returns the parent workspace's metadata and configuration - including custom_instructions that should be reserved for workspace- or admin-level keys. No public exploit was identified at time of analysis, though reference material from VulnCheck and a technical write-up document the request flow and vulnerable code paths.