---
id: "CVE-2026-123022"
kind: "vulnerability"
aliases: ["CVE-2026-123022"]
title: "AgentScope: unauthenticated API caller can make the server run any program through the MCP workspace endpoint"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "agentscope", "fixed": [], "affected": "<= 2.0.11", "ecosystem": "pip"}]
ecosystems: []
tags: ["agentscope", "ai-tooling", "mcp", "python", "self-hosted"]
not_affected_if: ["auth-required", "localhost-only", "no-mcp-workspace-api"]
published_at: "2026-11-05T14:17:04+00:00"
first_seen_at: "2026-11-05T14:39:18+00:00"
updated_at: "2026-11-05T14:41:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123022", "first_seen_at": "2026-11-05T14:39:18+00:00"}, {"source": "analyst", "url": "https://github.com/agentscope-ai/agentscope/issues/3312", "first_seen_at": "2026-11-05T14:41:50+00:00", "cites": ["https://github.com/agentscope-ai/agentscope/issues/3312", "https://github.com/agentscope-ai/agentscope/pull/3448", "https://github.com/ybyu-ieu/agent-security-advisories/blob/main/agentscope/agentscope-mcp-stdio-workspace-unauthenticated-process-execution.md"]}]
exploit_sources: [{"type": "poc", "url": "https://github.com/ybyu-ieu/agent-security-advisories/blob/main/agentscope/agentscope-mcp-stdio-workspace-unauthenticated-process-execution.md"}]
---

# AgentScope: unauthenticated API caller can make the server run any program through the MCP workspace endpoint

AgentScope's POST /workspace/mcp accepts a stdio MCP config whose command field is any string and starts that program when the config is saved. The endpoint trusts a caller-set X-User-ID header, so there is no real authentication. A reporter showed code running as the server's OS user on v2.0.4, and another user reproduced it on main (2.0.11dev). A public PoC exists; no in-the-wild exploitation is reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pip:agentscope affected <= 2.0.11 fixed no fixed version listed

## How to check

- Run pip show agentscope. Reporter tested 2.0.4; NVD lists up to 2.0.11. No fixed release exists.
- Check whether your service exposes POST /workspace/mcp (agent_service example binds 0.0.0.0:8000) to anything but trusted callers.
- Look in the workspace .mcp files and logs for stdio_mcp entries you did not create. A failed MCP handshake (HTTP 500) can mean the process already ran.

## Fix

No fixed release as of 2026-11-05. Issue #3312 is open; PR #3448 (opt-in allowed_stdio_commands in create_app, by a contributor, not yet merged) is partial and adds no authentication.

## Timeline

- 2026-11-05T14:39:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123022
- 2026-11-05T14:41:50+00:00 analyst https://github.com/agentscope-ai/agentscope/issues/3312 — Read GitHub issue #3312 (reporter advisory, bot label triage/confirmed), PR #3448 and the researcher write-up. NVD calls it 'command injection' but it is unauthenticated arbitrary command config; reporter CVSS 9.8, VulDB 7.3. No maintainer advisory or fix found, so nothing marked verified. Workaround from reporter: bind to 127.0.0.1 and block POST /workspace/mcp at the proxy. Sibling CVE-2026-123024 covers the X-User-ID auth gap.

## Documents

- [advisory] AgentScope #3312: unauthenticated arbitrary process execution via MCP stdio workspace configuration https://github.com/agentscope-ai/agentscope/issues/3312
- [mitigation] AgentScope PR #3448: opt-in allowlist for stdio MCP commands (open) https://github.com/agentscope-ai/agentscope/pull/3448
- [poc] Researcher advisory and PoC: AgentScope MCP stdio workspace process execution https://github.com/ybyu-ieu/agent-security-advisories/blob/main/agentscope/agentscope-mcp-stdio-workspace-unauthenticated-process-execution.md

## From the sources

A vulnerability was detected in agentscope-ai AgentScope up to 2.0.11. The impacted element is the function subprocess.Popen of the file src/agentscope/mcp/_config.py of the component MCP Workspace API. The manipulation of the argument command results in os command injection. The attack may be launched remotely. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_