CVE-2026-27961

HIGH

Agenta < 0.86.8 - Server-Side Template Injection in Evaluator Template Rendering

Title source: llm
STIX 2.1

Description

Agenta is an open-source LLMOps platform. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 0.86.8 in Agenta's API server evaluator template rendering. Although the vulnerable code lives in the SDK package, it is executed server-side within the API process when running evaluators. This does not affect standalone SDK usage — it only impacts self-hosted or managed Agenta platform deployments. Version 0.86.8 contains a fix for the issue.

References (1)

Core 1
Core References

Scores

CVSS v3 8.8
EPSS 0.0032
EPSS Percentile 23.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-1336
Status published
Products (1)
agentatech/agenta < 0.86.8
Published Feb 26, 2026
Tracked Since Feb 26, 2026