AGENTSCOPE · CVE-2026-123022 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
AgentScope's POST /workspace/mcp accepts a stdio MCP config whose command field is any string and starts that program when the config is saved. The endpoint trusts a caller-set X-User-ID header, so there is no real authentication. A reporter showed code running as the server's OS user on v2.0.4, and another user reproduced it on main (2.0.11dev). A public PoC exists; no in-the-wild exploitation is reported.
first public Nov 5, 2026 · 1 public exploit · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted AgentScope agent services (the example service binds 0.0.0.0:8000, LocalWorkspace by default) whose API can be reached by untrusted clients are exposed: one HTTP request can start any program as the server's OS user, exposing local files and LLM API keys. Docker and E2B workspaces run the program inside the sandbox, but it still runs. Deployments bound to localhost, or behind a proxy that blocks POST /workspace/mcp or adds real authentication, can mostly skip it.
Not affected if auth-required, localhost-only, no-mcp-workspace-api
Who cares agentscope, mcp, python, self-hosted
A vulnerability was detected in agentscope-ai AgentScope up to 2.0.11. The impacted element is the function subprocess.Popen of the file src/agentscope/mcp/_config.py of the component MCP Workspace API. The manipulation of the argument command results in os command injection. The attack may be launched remotely. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance.
This page as ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.