agenta-ai agenta-api vulnerabilities

Latest agenta-ai agenta-api CVEs

Newest publication first

1. CVE-2026-27952 Agenta has Python Sandbox Escape, Leading to Remote Code Execution (RCE)

   Published 2026-02-26

   Critical·CVSS 9.9 EPSS 0.57%

   Agenta is an open-source LLMOps platform. In Agenta-API prior to version 0.48.1, a Python sandbox escape vulnerability existed in Agenta's custom code evaluator. Agenta used RestrictedPython as a sandboxing mechanism for user-supplied evaluator code, but incorrectly whitelisted t...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.