CVE-2026-123024mediumCWE-287CWE-306

CVE-2026-123024: medium-severity vulnerability in agentscope-ai AgentScope

agentscope-ai AgentScope Agent Service deps.py get_current_user_id missing authentication

Published

Follow this CVE+ Monitor AgentScope

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.9epss 0.7%
A vulnerability has been found in agentscope-ai AgentScope up to 2.0.11. This impacts the function get_current_user_id of the file src/agentscope/app/deps.py of the component Agent Service. Such manipulation of the argument X-User-ID leads to missing authentication. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
agentscope-ai · AgentScope
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — agentscope-ai AgentScope

In the same product, most dangerous first.

CVE-2026-123022MEDIUMagentscope-ai AgentScope MCP Workspace API _config.py subprocess.Popen os command injectionEPSS 1.6%CVE-2026-123023MEDIUMagentscope-ai AgentScope Bash Tool _bash.py check_permissions authorizationEPSS 0.6%