CVE-2026-123024

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123024", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-11-05T06:25:59.245Z", "datePublished": "2026-11-05T13:45:17.370Z", "dateUpdated": "2026-11-05T21:22:16.968Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-11-05T13:45:17.370Z"}, "title": "agentscope-ai AgentScope Agent Service deps.py get_current_user_id missing authentication", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-306", "lang": "en", "description": "Missing Authentication"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-287", "lang": "en", "description": "Improper Authentication"}]}], "affected": [{"vendor": "agentscope-ai", "product": "AgentScope", "versions": [{"version": "2.0.0", "status": "affected"}, {"version": "2.0.1", "status": "affected"}, {"version": "2.0.2", "status": "affected"}, {"version": "2.0.3", "status": "affected"}, {"version": "2.0.4", "status": "affected"}, {"version": "2.0.5", "status": "affected"}, {"version": "2.0.6", "status": "affected"}, {"version": "2.0.7", "status": "affected"}, {"version": "2.0.8", "status": "affected"}, {"version": "2.0.9", "status": "affected"}, {"version": "2.0.10", "status": "affected"}, {"version": "2.0.11", "status": "affected"}], "cpes": ["cpe:2.3:a:agentscope-ai:agentscope:*:*:*:*:*:*:*:*"], "modules": ["Agent Service"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in agentscope-ai AgentScope up to 2.0.11. This impacts the function get_current_user_id of the file src/agentscope/app/deps.py of the component Agent Service. Such manipulation of the argument X-User-ID leads to missing authentication. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}], "timeline": [{"time": "2026-11-05T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-11-05T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-11-05T07:31:14.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Ybyu (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/431397", "name": "VDB-431397 | agentscope-ai AgentScope Agent Service deps.py get_current_user_id missing authentication", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/431397/cti", "name": "VDB-431397 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-123024", "name": "CVE-2026-123024 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/1033132", "name": "Submit #1033132 | agentscope-ai AgentScope 2.0.4 CWE-306 Missing Authentication for Critical Function", "tags": ["third-party-advisory"]}, {"url": "https://github.com/agentscope-ai/agentscope/issues/3314", "tags": ["issue-tracking"]}, {"url": "https://github.com/agentscope-ai/agentscope/pull/3448", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/ybyu-ieu/agent-security-advisories/blob/main/agentscope/agentscope-agent-service-x-user-id-missing-authentication.md", "tags": ["exploit"]}, {"url": "https://github.com/agentscope-ai/agentscope/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202611"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T21:22:11.821672Z", "id": "CVE-2026-123024", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:22:16.968Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-123024", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:22:11.821672Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:22:01.047Z"}}], "cna": {"title": "agentscope-ai AgentScope Agent Service deps.py get_current_user_id missing authentication", "credits": [{"lang": "en", "type": "reporter", "value": "Ybyu (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:agentscope-ai:agentscope:*:*:*:*:*:*:*:*"], "vendor": "agentscope-ai", "modules": ["Agent Service"], "product": "AgentScope", "versions": [{"status": "affected", "version": "2.0.0"}, {"status": "affected", "version": "2.0.1"}, {"status": "affected", "version": "2.0.2"}, {"status": "affected", "version": "2.0.3"}, {"status": "affected", "version": "2.0.4"}, {"status": "affected", "version": "2.0.5"}, {"status": "affected", "version": "2.0.6"}, {"status": "affected", "version": "2.0.7"}, {"status": "affected", "version": "2.0.8"}, {"status": "affected", "version": "2.0.9"}, {"status": "affected", "version": "2.0.10"}, {"status": "affected", "version": "2.0.11"}]}], "timeline": [{"lang": "en", "time": "2026-11-05T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-11-05T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-11-05T07:31:14.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/431397", "name": "VDB-431397 | agentscope-ai AgentScope Agent Service deps.py get_current_user_id missing authentication", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/431397/cti", "name": "VDB-431397 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-123024", "name": "CVE-2026-123024 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/1033132", "name": "Submit #1033132 | agentscope-ai AgentScope 2.0.4 CWE-306 Missing Authentication for Critical Function", "tags": ["third-party-advisory"]}, {"url": "https://github.com/agentscope-ai/agentscope/issues/3314", "tags": ["issue-tracking"]}, {"url": "https://github.com/agentscope-ai/agentscope/pull/3448", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/ybyu-ieu/agent-security-advisories/blob/main/agentscope/agentscope-agent-service-x-user-id-missing-authentication.md", "tags": ["exploit"]}, {"url": "https://github.com/agentscope-ai/agentscope/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202611"], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in agentscope-ai AgentScope up to 2.0.11. This impacts the function get_current_user_id of the file src/agentscope/app/deps.py of the component Agent Service. Such manipulation of the argument X-User-ID leads to missing authentication. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "Missing Authentication"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "Improper Authentication"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-11-05T13:45:17.370Z"}}}, "cveMetadata": {"cveId": "CVE-2026-123024", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:22:16.968Z", "dateReserved": "2026-11-05T06:25:59.245Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-11-05T13:45:17.370Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:agentscope-ai:agentscope:*:*:*:*:*:*:*:*"], "modules": ["Agent Service"], "product": "AgentScope", "vendor": "agentscope-ai", "versions": [{"status": "affected", "version": "2.0.0"}, {"status": "affected", "version": "2.0.1"}, {"status": "affected", "version": "2.0.2"}, {"status": "affected", "version": "2.0.3"}, {"status": "affected", "version": "2.0.4"}, {"status": "affected", "version": "2.0.5"}, {"status": "affected", "version": "2.0.6"}, {"status": "affected", "version": "2.0.7"}, {"status": "affected", "version": "2.0.8"}, {"status": "affected", "version": "2.0.9"}, {"status": "affected", "version": "2.0.10"}, {"status": "affected", "version": "2.0.11"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in agentscope-ai AgentScope up to 2.0.11. This impacts the function get_current_user_id of the file src/agentscope/app/deps.py of the component Agent Service. Such manipulation of the argument X-User-ID leads to missing authentication. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance."}], "id": "CVE-2026-123024", "lastModified": "2026-11-05T22:17:55.410", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-123024", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:22:11.821672Z", "version": "2.0.3"}}]}, "published": "2026-11-05T14:17:04.470", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/agentscope-ai/agentscope/"}, {"source": "cna@vuldb.com", "url": "https://github.com/agentscope-ai/agentscope/issues/3314"}, {"source": "cna@vuldb.com", "url": "https://github.com/agentscope-ai/agentscope/pull/3448"}, {"source": "cna@vuldb.com", "url": "https://github.com/ybyu-ieu/agent-security-advisories/blob/main/agentscope/agentscope-agent-service-x-user-id-missing-authentication.md"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-123024"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/1033132"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/431397"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/431397/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-306"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.0.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.0.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.0.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.0.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.0.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.0.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.0.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.0.9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.0.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.0.11"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "AgentScope", "source": "cna", "vendor": "agentscope-ai"}, "product": "agentscope", "vendor": "agentscope-ai"}], "created": "2026-11-05T15:30:11.686011+00:00", "updated": "2026-11-05T17:00:09.582748+00:00", "vendors": ["agentscope-ai", "agentscope-ai$PRODUCT$agentscope"]}