{"id":"CVE-2026-123022","kind":"vulnerability","aliases":["CVE-2026-123022"],"related":[],"title":"AgentScope: unauthenticated API caller can make the server run any program through the MCP workspace endpoint","description":"A vulnerability was detected in agentscope-ai AgentScope up to 2.0.11. The impacted element is the function subprocess.Popen of the file src/agentscope/mcp/_config.py of the component MCP Workspace API. The manipulation of the argument command results in os command injection. The attack may be launched remotely. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance.","summary":"AgentScope's POST /workspace/mcp accepts a stdio MCP config whose command field is any string and starts that program when the config is saved. The endpoint trusts a caller-set X-User-ID header, so there is no real authentication. A reporter showed code running as the server's OS user on v2.0.4, and another user reproduced it on main (2.0.11dev). A public PoC exists; no in-the-wild exploitation is reported.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"agentscope","fixed":[],"affected":"<= 2.0.11","ecosystem":"pip"}],"ecosystems":[],"tags":["agentscope","ai-tooling","mcp","python","self-hosted"],"not_affected_if":["auth-required","localhost-only","no-mcp-workspace-api"],"how_to_check":"- Run pip show agentscope. Reporter tested 2.0.4; NVD lists up to 2.0.11. No fixed release exists.\n- Check whether your service exposes POST /workspace/mcp (agent_service example binds 0.0.0.0:8000) to anything but trusted callers.\n- Look in the workspace .mcp files and logs for stdio_mcp entries you did not create. A failed MCP handshake (HTTP 500) can mean the process already ran.","fix":"No fixed release as of 2026-11-05. Issue #3312 is open; PR #3448 (opt-in allowed_stdio_commands in create_app, by a contributor, not yet merged) is partial and adds no authentication.","status":"open","published_at":"2026-11-05T14:17:04+00:00","first_seen_at":"2026-11-05T14:39:18+00:00","triaged_at":"2026-11-05T14:40:24+00:00","updated_at":"2026-11-05T14:41:50+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-05T14:40:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"AgentScope: MCP workspace config lets remote attackers inject OS commands","impact":"high","summary":"AgentScope, an agent framework from agentscope-ai, passes the command argument of its MCP Workspace API into a subprocess call without sanitizing it. A remote attacker can inject operating system commands through that argument, which runs with the privileges of the AgentScope process.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["python","agentscope","mcp"],"confidence":0.6,"fix_status":"none","needs_auth":"unknown","worst_case":"Remote attacker runs arbitrary operating system commands on the server","analyst_note":"Confirm the fixed AgentScope release and whether the MCP Workspace API requires authentication; check the pending fix pull request on the agentscope-ai repository.","how_to_check":"- Check the installed AgentScope version with `pip show agentscope`; versions up to `2.0.11` are listed as affected.\n- Look for use of the MCP Workspace API in `src/agentscope/mcp/_config.py` and whether it is reachable from outside your network.","plain_action":"","needs_analyst":true,"not_affected_if":["auth-required","no-mcp-workspace-api"],"who_is_affected":"Teams running AgentScope up to 2.0.11 with the MCP Workspace API reachable by untrusted callers are exposed, since the command argument reaches a subprocess call unsanitized. Deployments that keep the API internal or do not use MCP workspace configuration are less exposed. The sources say a fix pull request is pending but do not name a fixed release.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00073,"input_tokens":4252,"output_tokens":609,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed AgentScope release and whether the MCP Workspace API requires authentication; check the pending fix pull request on the agentscope-ai repository.","search":"'-123022':19A,22A '-2026':18A,21A '/workspace/mcp':36B '2.0.11':95B,120C 'accept':37B,172C 'agentscop':1A,24B,33B,115C,117C 'agentscope':23A 'agentscope-ai':114C 'ai':26B,116C 'ai-tool':25B 'anoth':89B 'api':3A,137C 'argument':142C 'attack':150C 'authent':74B 'await':171C 'caller':4A,62B 'caller-set':61B 'code':78B 'command':43B,143C,147C 'compon':134C 'config':41B,54B 'cve':17A,20A 'detect':112C 'dev':96B 'element':123C 'endpoint':16A,58B 'exist':100B 'exploit':106B,156C 'field':44B 'file':130C 'fix':168C 'function':126C 'header':68B 'host':32B 'id':67B 'impact':122C 'in-the-wild':102B 'inject':148C 'issu':170C 'launch':153C 'main':94B 'make':6A 'manipul':139C 'may':151C,161C 'mcp':14A,28B,40B,135C 'os':84B,146C 'poc':99B 'post':35B 'program':11A,51B 'public':98B,159C 'pull':165C 'python':29B 'real':73B 'remot':154C 'report':76B,108B 'reproduc':91B 'request':166C 'result':144C 'run':9A,79B 'save':56B 'self':31B 'self-host':30B 'server':8A,82B 'set':63B 'show':77B 'src/agentscope/mcp/_config.py':131C 'start':49B 'stdio':39B 'string':47B 'subprocess.popen':127C 'tool':27B 'trust':59B 'unauthent':2A 'use':163C 'user':66B,85B,90B 'v2.0.4':87B 'vulner':110C 'whose':42B 'wild':105B 'workspac':15A,136C 'x':65B 'x-user-id':64B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted AgentScope agent services (the example service binds 0.0.0.0:8000, LocalWorkspace by default) whose API can be reached by untrusted clients are exposed: one HTTP request can start any program as the server's OS user, exposing local files and LLM API keys. Docker and E2B workspaces run the program inside the sandbox, but it still runs. Deployments bound to localhost, or behind a proxy that blocks POST /workspace/mcp or adds real authentication, can mostly skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["agentscope"],"ptokens":["agentscope"],"labels":["agentscope","aitooling","high","mcp","python","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T14:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-123022","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123022","severity":null,"published_at":"2026-11-05T14:17:04+00:00","modified_at":"2026-11-05T14:17:04+00:00","first_seen_at":"2026-11-05T14:39:18+00:00","fetched_at":"2026-11-05T14:39:18+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123022:1782","url":"https://github.com/agentscope-ai/agentscope/issues/3312","severity":null,"published_at":"2026-11-05T14:41:50+00:00","modified_at":"2026-11-05T14:41:50+00:00","first_seen_at":"2026-11-05T14:41:50+00:00","fetched_at":"2026-11-05T14:41:50+00:00","note":"Read GitHub issue #3312 (reporter advisory, bot label triage/confirmed), PR #3448 and the researcher write-up. NVD calls it 'command injection' but it is unauthenticated arbitrary command config; reporter CVSS 9.8, VulDB 7.3. No maintainer advisory or fix found, so nothing marked verified. Workaround from reporter: bind to 127.0.0.1 and block POST /workspace/mcp at the proxy. Sibling CVE-2026-123024 covers the X-User-ID auth gap.","cites":["https://github.com/agentscope-ai/agentscope/issues/3312","https://github.com/agentscope-ai/agentscope/pull/3448","https://github.com/ybyu-ieu/agent-security-advisories/blob/main/agentscope/agentscope-mcp-stdio-workspace-unauthenticated-process-execution.md"]}],"documents":[{"id":76990,"url":"https://github.com/agentscope-ai/agentscope/issues/3312","title":"AgentScope #3312: unauthenticated arbitrary process execution via MCP stdio workspace configuration","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":76991,"url":"https://github.com/agentscope-ai/agentscope/pull/3448","title":"AgentScope PR #3448: opt-in allowlist for stdio MCP commands (open)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":76992,"url":"https://github.com/ybyu-ieu/agent-security-advisories/blob/main/agentscope/agentscope-mcp-stdio-workspace-unauthenticated-process-execution.md","title":"Researcher advisory and PoC: AgentScope MCP stdio workspace process execution","kind":"poc","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"exploit_sources":[{"type":"poc","url":"https://github.com/ybyu-ieu/agent-security-advisories/blob/main/agentscope/agentscope-mcp-stdio-workspace-unauthenticated-process-execution.md"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}