AGENTSCOPE · CVE-2026-123024 · AI agents & MCP
NO FIX YET
AgentScope, an agent framework from agentscope-ai, up to version 2.0.11 trusts the X-User-ID request header in its Agent Service without checking authentication. A remote attacker can send a crafted header to act as another user.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running the AgentScope Agent Service (FastAPI, agentscope up to 2.0.11) with the stock get_current_user_id dependency are exposed: the user identity is whatever the caller puts in the X-User-ID header, so any client that can reach the service can act as any user. AgentScope's own docs call this header a placeholder, not authentication, and tell you to replace it with your own auth before deploying. If you already override it with real JWT/OAuth auth, or the service is only reachable from trusted clients behind an authenticating proxy, you can skip this.
Not affected if auth-required, custom-auth-dependency, internal-only-network
Who cares agent-service, agentscope, python, self-hosted
pip show agentscope; 2.0.11 or earlier is in range, and no fixed release exists yet.get_current_user_id in src/agentscope/app/deps.py (reads X-User-ID with no credential check) or overrides it with your own JWT/OAuth dependency.curl -H 'X-User-ID: someone' http://HOST:8000/... returning data means anyone can pick an identity.Posts are quoted with a link to the original. They are data to us, never instructions.
A vulnerability has been found in agentscope-ai AgentScope up to 2.0.11. This impacts the function get_current_user_id of the file src/agentscope/app/deps.py of the component Agent Service. Such manipulation of the argument X-User-ID leads to missing authentication. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
No fix yet, per the sources.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.