Vulnerability · Published Oct 11, 2026 · Assigned by VulnCheck

CVE-2026-108711Plastic Labs Honcho through 3.3.0 Incorrect Authorization via POST /v3/workspaces

Medium 4.3

In plain English

A medium-severity incorrect authorization in honcho from Plastic Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 79.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerability that allows peer- or session-scoped API key holders to read workspace data because get_or_create_workspace checks only the workspace claim. Attackers can submit their parent workspace name to the POST /v3/workspaces endpoint to retrieve workspace metadata and configuration, including custom_instructions, reserved for workspace or admin keys.

Affected products (as reported)

Vendor	Product	Versions
Plastic Labs	honcho	0 – through 3.3.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://hackmd.io/@haind/honcho-scoped-jwt-workspace-config-disclosure third-party-advisory
https://github.com/plastic-labs/honcho/blob/608aec8a928da13c540262ed980c569448fb53ab/src/routers/workspaces.py#L41-L72 technical-description
https://github.com/plastic-labs/honcho/blob/608aec8a928da13c540262ed980c569448fb53ab/src/security.py#L218-L225 technical-description
https://github.com/plastic-labs/honcho/blob/608aec8a928da13c540262ed980c569448fb53ab/src/crud/workspace.py#L112-L119 technical-description
https://github.com/plastic-labs/honcho product
VulnCheck Advisory: Plastic Labs Honcho through 3.3.0 Incorrect Authorization via POST /v3/workspaces third-party-advisory