CVE-2026-27961Disclosure(agentatech / agenta)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch agentatech agenta systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Agenta is an open-source LLMOps platform. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 0.86.8 in Agenta's API server evaluator template rendering. Although the vulnerable code lives in the SDK package, it is executed server-side within the API process when running evaluators. This does not affect standalone SDK usage — it only impacts self-hosted or managed Agenta platform deployments. Version 0.86.8 contains a fix for the issue.

agentatech CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/Agenta-AI/agenta/security/advisories/GHSA-cfr2-mp74-3763

Weakness type (CWE)

CWE-1336

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

agenta

Threat summary

Patch or workaround signal is available
5 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 5 signals
Disclosure: 4 classified signals
Peaked 1d ago at 4 mentions (2026-02-26); latest day: 1
5 total mentions across 2 days

Affected systems

Vendors

agentatech

Products

agenta

Deep dive

Activity timeline5 mentions / 2d

Signal classification2 categories

Disclosure

480.0%

Patch

120.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-26	4	Disclosure3Patch1
2026-03-03	1	Disclosure1

Full discourse5 posts

CRAC Learning - Tech@cracbot222d
Disclosure
CVE-2026-27961 (CVSS:8.8, HIGH) is Analyzed. Agenta is an open-source LLMOps platform. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior..https://nvd.nist.gov/vuln/detail/CVE-2026-27961 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post announces CVE-2026-27961, a high‑severity SSTI vulnerability in Agenta, with CVSS 8.8, and links to the NVD entry.
0001127
173 followersView on X
CVE@CVEnew227d
Disclosure
CVE-2026-27961 Agenta is an open-source LLMOps platform. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 0.86.8 in Agenta's API server evaluator te… https://www.cve.org/CVERecord?id=CVE-2026-27961
Post summary
The CVE-2026-27961 entry reports a Server‑Side Template Injection vulnerability in Agenta’s API server evaluator before version 0.86.8, with no mention of PoC, exploit, or patch.
00000111
56.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds227d
Disclosure
CVE-2026-27961 Server-Side Template Injection in Agenta API Server Evaluator Before 0.86.8 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27961
Post summary
A Server‑Side Template Injection vulnerability (CVE‑2026‑27961) exists in Agenta API Server Evaluator versions prior to 0.86.8.
0000046
4.0K followersView on X
CVEFind.com@CveFindCom228d
Patch
[CVE-2026-27961: HIGH] Beware of Server-Side Template Injection (SSTI) vulnerability in Agenta's API server evaluating templates before version 0.86.8. Upgrade to the latest version for protection.#cve,CVE-2026-27961,#cybersecurity https://cvefind.com/CVE-2026-27961
Post summary
The post alerts to a high‑severity SSTI vulnerability in Agenta’s API server (pre‑0.86.8) and recommends upgrading to the latest version for protection.
0000047
585 followersView on X
CVETodo@CveTodo228d
Disclosure
**CVE-2026-27961** pertains to a **Server-Side Template Injection (SSTI)** vulnerability in the Agenta platform, an open-source Large Language Model Operations (LLMOps) platform. This vulnerability affects versions prior to **0.86.8** and resides specifically within the API server’s evaluator template rendering mechanism. #Cybersecurity #CVE #HighSeverity #SecurityAlert #RemoteCodeExecution #PrivilegeEscalation https://cvetodo.com/cve/CVE-2026-27961
Post summary
The post announces CVE-2026-27961, a Server‑Side Template Injection in the Agenta platform affecting versions before 0.86.8, with no mention of PoC, exploit, or patch.
0000044
20 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	agentatech	agenta	-	-	-

Explore more

Back to dashboard agentatech CVEs agenta vulnerabilities

What researchers are saying

CVE-2026-27961

CVETodo[verified]@CveTodoDisclosure

The post announces CVE-2026-27961, a Server‑Side Template Injection in the Agenta platform affecting versions before 0.86.8, with no mention of PoC, exploit, or patch.

CRAC Learning - Tech@cracbotDisclosure

The post announces CVE-2026-27961, a high‑severity SSTI vulnerability in Agenta, with CVSS 8.8, and links to the NVD entry.

CVE@CVEnewDisclosure

The CVE-2026-27961 entry reports a Server‑Side Template Injection vulnerability in Agenta’s API server evaluator before version 0.86.8, with no mention of PoC, exploit, or patch.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A Server‑Side Template Injection vulnerability (CVE‑2026‑27961) exists in Agenta API Server Evaluator versions prior to 0.86.8.

CVEFind.com@CveFindComPatch

The post alerts to a high‑severity SSTI vulnerability in Agenta’s API server (pre‑0.86.8) and recommends upgrading to the latest version for protection.