AgentScope agent service has no login check: three CVEs published, two still unpatched

AgentScope, an open-source framework for building AI agents with about 35,000 GitHub stars, ships an "agent service" that does not authenticate anyone: any request can claim to be any user, and one of its endpoints will start a program named in the request. Three CVEs were published on November 5, 2026; the two most serious (CVE-2026-123022 and CVE-2026-123024) affect every 2.0 release through the current 2.0.11 and have no fix yet. If you run the AgentScope agent service, keep it off the internet and shared networks today, put an authenticating proxy in front of it, and rotate any AI provider keys stored in it.

What happened, in plain English

AgentScope is a Python toolkit for building AI agents: programs that use a large language model (LLM) to plan tasks and call tools. Version 2.0, released in May 2026, added an "agent service": a small web server, with a web interface, that lets many users share the same agents, each with their own sessions, settings and saved API keys (the secret tokens that let software use paid AI services such as OpenAI or Alibaba's DashScope).

The service decides who you are by reading a single header, X-User-ID, that the caller sets themselves. Nothing checks it. It is like a hotel that hands out room keys to anyone who says a room number at the front desk. Whoever can reach the service can be any user, and see or change that user's data, including stored AI keys.

The second problem sits on top of the first. The service lets users add MCP servers (Model Context Protocol, the standard way to plug tools into an agent). One type of MCP server is a local program that the service starts on its own machine. The service accepts the name of that program from the request and runs it, with no allowlist. Put together, anyone who can reach the service can make the server run programs with the permissions of the account that runs AgentScope.

An independent researcher (GitHub user ybyu-ieu) reported both issues privately on July 8, 2026, went public on October 14 after receiving no response, and VulDB assigned CVE IDs on November 5. A project bot has labelled both issues "confirmed"; no maintainer has commented publicly, and proposed fixes are still awaiting review.

Are you affected? What to do now

You are affected if you run the AgentScope agent service (the FastAPI web server and web UI introduced in 2.0) on versions 2.0.0 to 2.0.11. If you only import AgentScope as a library in your own scripts and never start the agent service, CVE-2026-123022 and CVE-2026-123024 do not apply to you. Most readers do not use AgentScope at all and have nothing to do.

How to check

• Find installs: pip show agentscope (or check requirements.txt, lock files and container images). Any 2.0.x version up to 2.0.11 is affected; 2.0.11 is the latest on PyPI (October 27, 2026).
• Find running services: look for a process serving the AgentScope agent service, by default on port 8000. According to issue #3314, the official example binds to 0.0.0.0:8000 (all network interfaces) with no authentication.
• Check exposure: can the port be reached from outside the host — the internet, a VPN, a shared office or cloud network?

What to do, in order

1. Remove network exposure. Bind the service to 127.0.0.1 (the researcher's suggested workaround), or block the port with a firewall or security group so only trusted hosts reach it.
2. Put authentication in front. If others must use it, place it behind a reverse proxy or gateway that requires real login (SSO, OAuth, or at minimum a strong shared secret). Do not rely on the X-User-ID header for anything.
3. Restrict MCP configuration. Until a fix is released, block requests that add MCP servers through the workspace API at the proxy if you do not need that feature.
4. Run with least privilege. Run the service as a dedicated low-privilege user or in a container without access to other secrets, SSH keys or the cloud metadata service.
5. Rotate secrets if the service was ever reachable by untrusted users: LLM API keys stored in AgentScope, plus credentials available to the account that runs it.
6. Upgrade to at least 2.0.9 to fix the separate Bash tool flaw (CVE-2026-123023), and watch the project for a release that addresses the other two.
7. Review logs for requests from unexpected IP addresses, unfamiliar user IDs, new MCP server entries, and unexpected child processes of the AgentScope server. No official indicators of compromise have been published, and no attacks have been reported.

The expert view

Root cause. This is not an AI-specific bug; it is a missing authentication layer (CWE-306) in a web service that happens to orchestrate agents. A code comment in the project describes the header-based identity as temporary, to "be replaced by JWT auth". The problem is that the temporary design shipped in every 2.0 release, and the official example listens on all interfaces. Multi-tenant features (per-user sessions, stored keys) without verified identity give a false sense of separation.

The chain. The command-injection flaw (CWE-78, CVE-2026-123022) needs no AI trickery: the stdio transport in MCP means "start this local program", and the service takes the program name from the caller. The researcher notes that the process starts before the MCP handshake, so a request can fail while its command has already run — which matters for detection, since errors in the logs do not mean nothing happened. Combined with the missing authentication (CVE-2026-123024), the result is unauthenticated remote code execution on whatever reaches the port. The same pattern — tool registration that is in practice "run any command" — has shown up in several MCP gateways and agent platforms this year.

Severity in context. VulDB, acting as CVE numbering authority, scored each issue 6.9 (CVSS 4.0, Medium) and 7.3 (CVSS 3.1, High). The researcher rates them 9.8, and Red Hat's draft score for CVE-2026-123022 is also 9.8. We think the CNA scores understate the chained impact for exposed deployments: no credentials, no user interaction, code execution on the host. For services bound to localhost behind real authentication, the risk is much lower. CISA's SSVC data lists exploitation as "none" and none of the CVEs is in the KEV catalog; the CVE records reference publicly available proof-of-concept material.

The fixes on the table are partial. PR #3329 adds an opt-in shared API key (off unless AGENTSCOPE_API_KEY is set) and its author calls it a "stopgap". PR #3448 adds an opt-in allowlist for stdio MCP commands and does not add authentication. Neither had been reviewed when we last checked on November 9, 2026, and issue #3312 was still open with no maintainer comment. Even when merged, both must be switched on deliberately.

What is still unknown. There is no maintainer statement, no timeline for a release, and no data on how many agent services are exposed online. The four-month gap between the private report and any public response is itself a signal: teams adopting fast-moving open-source agent frameworks should check whether a project actually handles security reports before putting it in front of users.

Official sources

• AgentScope GitHub issue #3312 — arbitrary process execution via the workspace MCP endpoint (CVE-2026-123022): https://github.com/agentscope-ai/agentscope/issues/3312
• AgentScope GitHub issue #3314 — no authentication, X-User-ID spoofing (CVE-2026-123024): https://github.com/agentscope-ai/agentscope/issues/3314
• CVE-2026-123022 record (OpenCVE / NVD data): https://app.opencve.io/cve/CVE-2026-123022
• CVE-2026-123024 record: https://app.opencve.io/cve/CVE-2026-123024
• CVE-2026-123023 record (Bash tool, fixed in 2.0.9): https://app.opencve.io/cve/CVE-2026-123023
• Proposed fix PR #3329 (opt-in API-key middleware): https://github.com/agentscope-ai/agentscope/pull/3329
• Proposed fix PR #3448 (opt-in stdio MCP allowlist): https://github.com/agentscope-ai/agentscope/pull/3448
• AgentScope release history (PyPI): https://pypi.org/project/agentscope/
• Coverage: PointGuard AI incident tracker: https://www.pointguardai.com/ai-security-incidents/agentscope-flaws-expose-mcp-workspace-to-unauthenticated-command-injection-cve-2026-123022-cve-2026-123024