CVE-2026-27961 - Vulnerability Analysis

Overview

Agenta < 0.86.8 contains a server side template injection caused by unsafe template rendering in the API server evaluator, letting remote attackers execute arbitrary code server-side, exploit requires API server usage.

Severity & Score

Impact

Remote attackers can execute arbitrary code on the server, potentially leading to full system compromise.

Mitigation

Upgrade to version 0.86.8 or later.

References

• https://github.com/Agenta-AI/agenta/security/advisories/GHSA-cfr2-mp74-3763

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 26, 2026

🟠 CVE-2026-27961 - High (8.8) Agenta is an open-source LLMOps platform. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 0.86.8 in Agenta's API server evaluator template rendering. Although the vulnerable code lives in the SDK package, it is ex... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27961/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner