Agenta prior to version 0.122.5 includes a server-side request forgery flaw that allows any workspace member with editing rights to modify the workflow revision URL. When a revision is invoked, the server performs the request using an internal Authorization token that enables reading secrets from the vault API. By specifying an arbitrary URL, an attacker can capture the attached token and leak sensitive configuration data, or reach internal or cloud metadata endpoints for further exploitation.

This issue affects all installations of Agenta before v0.122.5, including 0.122.4 and earlier releases. The vulnerability exists for any user who has workflow edit permissions within the affected workspace.

The CVSS score of 8.4 reflects the high impact of the vulnerability, and while no EPSS value is available, the nature of SSRF and the token leakage indicates a non‑negligible exploitation risk. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by performing an internal network request from within the Agenta instance, so the attack vector is likely driven by authenticated users with workflow update privileges who can redirect requests to malicious or internal services.