CVE-2026-108711

Name of the Vulnerable Software and Affected Versions Plastic Labs Honcho versions prior to 3.3.1

Description An incorrect authorization issue exists where holders of peer- or session-scoped API keys can access workspace data. This occurs because the get or create workspace() function only verifies the workspace claim. An attacker can provide the parent workspace name to the 'POST /v3/workspaces' endpoint to retrieve workspace metadata and configuration, such as custom instructions, which should be restricted to workspace or admin keys.

Recommendations Update Plastic Labs Honcho to version 3.3.1 or later. As a temporary mitigation, restrict access to the 'POST /v3/workspaces' endpoint for users with peer- or session-scoped API keys.