CVE-2026-123024

AgentScope accepts a caller-supplied user ID as identity

agentscope-ai · AgentScope Agent Service tenant endpoints

First documented disclosure · Review checkpoint

Summary

A caller can impersonate another user by choosing the value of an HTTP header.

Severity and exploitation evidence

Medium · 6.9/10 · CVSS 4.0. Severity source.

Exploitation not established: The research report documents cross-user credential and resource access using a controlled service. No malicious exploitation was established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The built-in identity dependency takes a nonempty X-User-ID as the user identity. Tenant data lookups then use that identity without proving who sent it.

Conditions required

An untrusted caller can reach the service without a trusted gateway that authenticates the request, strips the inbound identity header and supplies its own value.

Potential impact

A caller who knows another user’s ID can access or modify that user’s resources, including agents, credentials and sessions.

Affected versions and configurations

VulDB lists releases through 2.0.11. The researcher tested the 2.0.4 service example.

Fix and mitigation status

No verified identity fix. The linked open PR adds an optional MCP command allowlist and does not establish who owns a supplied user ID.

Practical next steps

Place the service behind an authenticated gateway, block direct access and inject a verified identity only after removing caller-supplied headers.

Operating lesson

Enforce tenant ownership using an authenticated principal on every request.

Evidence and limits

The October 14 issue predates the November 5 CVE. Open PR 3329 proposes an optional shared-key gate, which does not verify the tenant user’s identity.

Sources