CVE-2026-27961

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27961", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-25T03:24:57.792Z", "datePublished": "2026-02-26T01:39:09.997Z", "dateUpdated": "2026-02-26T19:29:04.883Z"}, "containers": {"cna": {"title": "Agenta's Server-Side Template Injection (SSTI) via custom evaluator Jinja2 templates allows RCE", "problemTypes": [{"descriptions": [{"cweId": "CWE-1336", "lang": "en", "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/Agenta-AI/agenta/security/advisories/GHSA-cfr2-mp74-3763", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Agenta-AI/agenta/security/advisories/GHSA-cfr2-mp74-3763"}], "affected": [{"vendor": "Agenta-AI", "product": "agenta", "versions": [{"version": "< 0.86.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T01:39:09.997Z"}, "descriptions": [{"lang": "en", "value": "Agenta is an open-source LLMOps platform. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 0.86.8 in Agenta's API server evaluator template rendering. Although the vulnerable code lives in the SDK package, it is executed server-side within the API process when running evaluators. This does not affect standalone SDK usage \u2014 it only impacts self-hosted or managed Agenta platform deployments. Version 0.86.8 contains a fix for the issue."}], "source": {"advisory": "GHSA-cfr2-mp74-3763", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T19:28:54.001382Z", "id": "CVE-2026-27961", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T19:29:04.883Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27961", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-26T19:28:54.001382Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T19:28:59.844Z"}}], "cna": {"title": "Agenta's Server-Side Template Injection (SSTI) via custom evaluator Jinja2 templates allows RCE", "source": {"advisory": "GHSA-cfr2-mp74-3763", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Agenta-AI", "product": "agenta", "versions": [{"status": "affected", "version": "< 0.86.8"}]}], "references": [{"url": "https://github.com/Agenta-AI/agenta/security/advisories/GHSA-cfr2-mp74-3763", "name": "https://github.com/Agenta-AI/agenta/security/advisories/GHSA-cfr2-mp74-3763", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Agenta is an open-source LLMOps platform. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 0.86.8 in Agenta's API server evaluator template rendering. Although the vulnerable code lives in the SDK package, it is executed server-side within the API process when running evaluators. This does not affect standalone SDK usage \u2014 it only impacts self-hosted or managed Agenta platform deployments. Version 0.86.8 contains a fix for the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1336", "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T01:39:09.997Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27961", "state": "PUBLISHED", "dateUpdated": "2026-02-26T19:29:04.883Z", "dateReserved": "2026-02-25T03:24:57.792Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-26T01:39:09.997Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "agenta", "vendor": "Agenta-AI", "versions": [{"status": "affected", "version": "< 0.86.8"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:agentatech:agenta:*:*:*:*:*:*:*:*", "matchCriteriaId": "FF609F89-BEC4-4CB7-8818-18575B3796E2", "versionEndExcluding": "0.86.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Agenta is an open-source LLMOps platform. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 0.86.8 in Agenta's API server evaluator template rendering. Although the vulnerable code lives in the SDK package, it is executed server-side within the API process when running evaluators. This does not affect standalone SDK usage \u2014 it only impacts self-hosted or managed Agenta platform deployments. Version 0.86.8 contains a fix for the issue."}, {"lang": "es", "value": "Agenta es una plataforma LLMOps de c\u00f3digo abierto. Una vulnerabilidad de inyecci\u00f3n de plantillas del lado del servidor (SSTI) existe en versiones anteriores a la 0.86.8 en la renderizaci\u00f3n de plantillas del evaluador del servidor API de Agenta. Aunque el c\u00f3digo vulnerable reside en el paquete SDK, se ejecuta del lado del servidor dentro del proceso de la API al ejecutar evaluadores. Esto no afecta el uso aut\u00f3nomo del SDK \u2014 solo afecta las implementaciones de la plataforma Agenta autoalojadas o gestionadas. La versi\u00f3n 0.86.8 contiene una soluci\u00f3n para el problema."}], "id": "CVE-2026-27961", "lastModified": "2026-06-17T10:27:58.610", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27961", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T19:28:54.001382Z", "version": "2.0.3"}}]}, "published": "2026-02-26T02:16:23.483", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/Agenta-AI/agenta/security/advisories/GHSA-cfr2-mp74-3763"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1336"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.86.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "agenta", "source": "cna", "vendor": "Agenta-AI"}, "product": "agenta", "vendor": "agenta-ai"}], "analysis": {"en": {"generated_at": "2026-04-18T10:26:20.081553+00:00", "value": {"mitigation_remediation": ["Upgrade Agenta to version 0.86.8 or newer to apply the vendor\u2011supplied fix.", "Restrict access to the evaluator API endpoint, ensuring that only authenticated users with the appropriate permissions can submit templates, and enforce least privilege for those users.", "If evaluator templates are not required for your deployment, disable the evaluator feature entirely or sandbox the template rendering context to a minimal, read\u2011only environment to prevent execution of arbitrary expressions."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Vendor Agenta\u2011AI\u2019s Agenta product, affected in every released version prior to 0.86.8. The fix is included in version 0.86.8 and later.", "description_and_impact": "Agenta is an open\u2011source LLMOps platform that contains a Server\u2011Side Template Injection flaw in its API server evaluator. The vulnerable code resides in the SDK package but is executed on the server when evaluators run, allowing an attacker to inject Jinja2 template expressions that the server will interpret, potentially leading to arbitrary code execution on the host. This issue is limited to self\u2011hosted or managed Agenta deployments; usage of the standalone SDK is not affected.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 8.8, indicating a high severity level. The EPSS score is below 1%, suggesting a low probability of exploitation at this time. It is not listed in the CISA KEV catalog. The likely attack vector involves an actor who can supply or influence evaluator templates, such as through a constructed API request. On a misconfigured or unauthenticated exposure of the evaluator endpoint, the attacker could trigger code execution from the server side."}}}}, "created": "2026-02-26T13:09:57.176269+00:00", "updated": "2026-04-18T10:30:35.765054+00:00", "vendors": ["agenta-ai", "agenta-ai$PRODUCT$agenta"]}