CVE-2026-123022

AgentScope can launch a process when a caller registers an MCP server

agentscope-ai · AgentScope Agent Service workspace MCP API

First documented disclosure · Review checkpoint

Summary

A request to add a stdio MCP server can immediately start an executable chosen by the caller.

Severity and exploitation evidence

Medium · 6.9/10 · CVSS 4.0. Severity source.

Exploitation not established: The researcher observed a marker file written by a locally launched child process. No production exploitation was reported.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The workspace accepts a command and arguments from the API, constructs a stateful stdio client and starts the process before the MCP handshake completes.

Conditions required

An untrusted caller can reach the affected API without an authentication boundary. The demonstrated example used LocalWorkspace.

Potential impact

The child process runs with service privileges in a local workspace. Other backends can confine it to their execution environment.

Affected versions and configurations

VulDB lists versions through 2.0.11. The researcher reproduced the behavior on 2.0.4.

Fix and mitigation status

No numbered fix verified. PR 3448 proposes an opt-in command allowlist and remained open at review.

Practical next steps

Restrict workspace registration to trusted administrators. Disable untrusted stdio commands or confine them behind a server-enforced allowlist.

Operating lesson

Registering a tool can start a process before the tool has authenticated or returned a response.

Evidence and limits

The October 14 disclosure predates the November 5 CNA. Proposed filtering alone does not authenticate a caller. This command-launch entry is distinct from CVE-2026-123024.

Sources