CVE-2026-123032

An unauthenticated socket can replace a registered agent’s connection

OpenBMB · Internet of Agents WebSocket connection manager

First documented disclosure · Review checkpoint

Summary

A client that knows another agent’s name can take its place on the message router.

Severity and exploitation evidence

Medium · 6.9/10 · CVSS 4.0. Severity source.

Exploitation not established: The researcher demonstrated interception using two test sockets and the same agent name. No production interception was reported.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The server indexes connections by an unverified name, accepts a second WebSocket under the same name and overwrites the existing mapping. Forwarded messages also trust the sender named by the client.

Conditions required

Network access to the WebSocket endpoint and knowledge of a registered agent’s name. Routing context is needed to send messages to particular conversations.

Potential impact

The legitimate agent stops receiving forwarded messages. The replacement can observe messages destined for that agent, impersonate its identity or disrupt collaboration.

Affected versions and configurations

The researcher tested revision 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. VulDB describes affected rolling revisions through that commit.

Fix and mitigation status

No issue-specific fixed release or upstream patch was verified in the reviewed sources.

Practical next steps

Restrict the message server to trusted peers. Require authenticated identities during the handshake, explicitly handle duplicate connections, and bind sender attribution to the authenticated socket.

Operating lesson

An agent name in a connection URL cannot authorize replacement of the agent that already uses it.

Evidence and limits

The October 14 issue contains the reproduction. The VulDB advisory and formal CVE followed November 5. The researcher’s proposed controls have not been verified as upstream changes.

Sources