VYPR
← All advisories
High severity8.8NVD Advisory· Published Feb 26, 2026· Updated Jun 17, 2026

CVE-2026-27961

CVE-2026-27961

Description

Agenta is an open-source LLMOps platform. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 0.86.8 in Agenta's API server evaluator template rendering. Although the vulnerable code lives in the SDK package, it is executed server-side within the API process when running evaluators. This does not affect standalone SDK usage — it only impacts self-hosted or managed Agenta platform deployments. Version 0.86.8 contains a fix for the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Agenta/Agentallm-fuzzy
    Range: <0.86.8
  • Agenta-AI/agentav5
    Range: < 0.86.8
  • Agentatech/Agenta
    cpe:2.3:a:agentatech:agenta:*:*:*:*:*:*:*:*
    Range: <0.86.8

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.