Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-86237

CVE-2026-86237MEDIUM

openagents-org openagents http.py test_default_model server-side request forgery

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   N    5.5   .0054   43.3     —

AFFECTED
  Product     Versions  Fixed
  openagents  0.8.0 –   —

TIMELINE
  Sep 6   Reserved by VulDB
  Sep 7   Published (CNA: VulDB)
  Sep 8   EXPLOIT PUBLISHED — CVE-2026-86237 (openagents-org openagents). Public exploit reference added.

CWE-918 · CNA: VulDB · CVSS v4.0 · 7 references · NVD status: Deferred

Description

A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20. Impacted is the function test_default_model of the file sdk/src/openagents/sdk/transports/http.py. Performing a manipulation of the argument base_url results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. Endpoint and both sinks unchanged since filing; only the file moved (e277dd1a). Maintainer closed as inapplicable yet the identical unguarded code still ships in 0.9.3.post20. Sibling admin endpoints do call the shipped-but-unused-by-this-handler _require_admin().

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
September 6, 2026	Reserved	Reserved by VulDB
September 7, 2026	Published	Published (CNA: VulDB)
September 8, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-86237 (openagents-org openagents). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
openagents-org	openagents	—	0.8.0	—

Weaknesses

CWE-918

References (7)

Authoritative record: CVE-2026-86237 at cve.org

Vendors: openagents-org

Weaknesses: CWE-918

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-86237 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.