AgentScope Agent Service missing authentication allows unauthorized access

An AI agent service can be entered by anyone without logging in.

Summary

Manipulating the X-User-ID value in AgentScope's Agent Service lets remote attackers get in without authentication. Versions up to 2.0.11 are affected, and public exploit code exists.

What to do

No fixed version is named yet. Check that you run a version newer than 2.0.11 and read the vendor's advisory.

Products and platforms

AgentScope

CVE IDs

CVE-2026-123024 (opens in a new tab)

Sources

Write-up: vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · github.com (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-05 13:45 UTC

First seen 2026-11-09 16:40 UTC