CVE-2026-108711 Plastic Labs CVE debrief

Who should care

Defenders responsible for Plastic Labs Honcho deployments should assess exposure and prioritize verification of the affected version. This includes reviewing the current version in use, checking for any existing mitigations, and planning for updates or patches. Additionally, defenders should consider the potential impact on their organization's security posture and take steps to minimize risk.

Why it matters

CVE-2026-108711 is a medium-severity vulnerability allowing unauthorized access to workspace data in Plastic Labs Honcho through version 3.3.0. Defenders should prioritize verification of the affected version and assess exposure.

• Verify affected version and assess exposure to unauthorized workspace data access
• Restrict access to the POST /v3/workspaces endpoint to prevent exploitation
• Implement proper authorization checks for workspace data access to prevent unauthorized data disclosure

Technical summary

The vulnerability in Plastic Labs Honcho through version 3.3.0 allows peer- or session-scoped API key holders to read workspace data via the POST /v3/workspaces endpoint. This issue arises from the get_or_create_workspace function only checking the workspace claim, enabling attackers to submit their parent workspace name and retrieve workspace metadata and configuration. The vulnerability has a medium severity and a CVSS score of 5.3. Defenders should prioritize verifying the affected version of Plastic Labs Honcho and assessing exposure.

Defensive priority

Defenders should prioritize verifying the affected version of Plastic Labs Honcho and assessing exposure, as the vulnerability allows unauthorized access to workspace data.

Recommended defensive actions

• Verify the version of Plastic Labs Honcho in use and assess exposure
• Restrict access to the POST /v3/workspaces endpoint
• Implement proper authorization checks for workspace data access
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to technical descriptions and advisories. Defenders should verify the affected version of Plastic Labs Honcho and assess exposure. The vulnerability allows peer- or session-scoped API key holders to read workspace data via the POST /v3/workspaces endpoint. This issue arises from the get_or_create_workspace function only checking the workspace claim, enabling attackers to submit their parent workspace name.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.