{"id":"CVE-2026-123024","kind":"vulnerability","aliases":["CVE-2026-123024"],"related":[],"title":"AgentScope: missing authentication in user ID header lets remote callers act as any user","description":"A vulnerability has been found in agentscope-ai AgentScope up to 2.0.11. This impacts the function get_current_user_id of the file src/agentscope/app/deps.py of the component Agent Service. Such manipulation of the argument X-User-ID leads to missing authentication. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.","summary":"AgentScope, an agent framework from agentscope-ai, up to version 2.0.11 trusts the X-User-ID request header in its Agent Service without checking authentication. A remote attacker can send a crafted header to act as another user.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"agentscope","fixed":[],"affected":"<= 2.0.11","ecosystem":"pypi"}],"ecosystems":[],"tags":["agent-service","agentscope","ai-tooling","python","self-hosted"],"not_affected_if":["auth-required","custom-auth-dependency","internal-only-network"],"how_to_check":"- Run `pip show agentscope`; 2.0.11 or earlier is in range, and no fixed release exists yet.\n- Check whether your app uses the stock `get_current_user_id` in src/agentscope/app/deps.py (reads X-User-ID with no credential check) or overrides it with your own JWT/OAuth dependency.\n- Check whether the Agent Service port (examples bind 0.0.0.0:8000) is reachable from untrusted networks. Test: `curl -H 'X-User-ID: someone' http://HOST:8000/...` returning data means anyone can pick an identity.","fix":null,"status":"open","published_at":"2026-11-05T14:17:04+00:00","first_seen_at":"2026-11-05T14:39:18+00:00","triaged_at":"2026-11-05T14:40:21+00:00","updated_at":"2026-11-05T14:41:37+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-05T14:40:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"AgentScope: missing authentication in user ID header lets remote callers act as any user","impact":"high","summary":"AgentScope, an agent framework from agentscope-ai, up to version 2.0.11 trusts the X-User-ID request header in its Agent Service without checking authentication. A remote attacker can send a crafted header to act as another user.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["agentscope","agent-service","python","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"remote caller impersonates any user through forged header","analyst_note":"Confirm the fixed version and whether the pull request has been merged; sources only list NVD and a pending PR.","how_to_check":"- Check the installed AgentScope version with `pip show agentscope` and see whether it is `2.0.11` or earlier.\n- Look at src/agentscope/app/deps.py for the get_current_user_id function and whether it reads X-User-ID without verifying credentials.\n- Check whether the Agent Service is reachable from the internet or untrusted networks.","plain_action":"","needs_analyst":true,"not_affected_if":["auth-required","internal-only-network"],"who_is_affected":"Teams that run the AgentScope Agent Service and expose it to a network beyond their own trusted users are exposed, because the user identity comes from a request header that is not verified. Deployments where the service is only reachable by trusted internal clients behind authentication are less exposed. The sources do not state a fixed version; a pull request to fix it is pending.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000724,"input_tokens":4258,"output_tokens":596,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether the pull request has been merged; sources only list NVD and a pending PR.","search":"'-123024':17A,20A '-2026':16A,19A '2.0.11':44B,85C 'accept':142C 'act':11A,69B 'agent':23B,35B,55B,101C 'agent-servic':22B 'agentscop':1A,25B,33B,39B,80C,82C 'agentscope':21A 'agentscope-ai':38B,79C 'ai':27B,40B,81C 'ai-tool':26B 'anoth':71B 'argument':107C 'attack':62B,117C 'authent':3A,59B,115C 'await':141C 'caller':10A 'check':58B 'compon':100C 'craft':66B 'current':91C 'cve':15A,18A 'disclos':126C 'execut':120C 'exploit':123C 'file':96C 'fix':138C 'found':77C 'framework':36B 'function':89C 'get':90C 'header':7A,52B,67B 'host':32B 'id':6A,50B,93C,111C 'impact':87C 'issu':140C 'lead':112C 'let':8A 'manipul':104C 'may':131C 'miss':2A,114C 'public':129C 'pull':135C 'python':29B 'remot':9A,61B,121C 'request':51B,136C 'self':31B 'self-host':30B 'send':64B 'servic':24B,56B,102C 'src/agentscope/app/deps.py':97C 'tool':28B 'trust':45B 'use':133C 'user':5A,14A,49B,72B,92C,110C 'version':43B 'vulner':74C 'without':57B 'x':48B,109C 'x-user-id':47B,108C","nicknames":[],"mitigations":[],"who_affected":"Teams running the AgentScope Agent Service (FastAPI, agentscope up to 2.0.11) with the stock get_current_user_id dependency are exposed: the user identity is whatever the caller puts in the X-User-ID header, so any client that can reach the service can act as any user. AgentScope's own docs call this header a placeholder, not authentication, and tell you to replace it with your own auth before deploying. If you already override it with real JWT/OAuth auth, or the service is only reachable from trusted clients behind an authenticating proxy, you can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["agentscope"],"ptokens":["agentscope"],"labels":["agentscope","agentservice","aitooling","high","python","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T14:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123024","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123024","severity":null,"published_at":"2026-11-05T14:17:04+00:00","modified_at":"2026-11-05T14:17:04+00:00","first_seen_at":"2026-11-05T14:39:18+00:00","fetched_at":"2026-11-05T14:39:18+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123024:1781","url":"https://docs.agentscope.io/en/versions/2.0.4/deploy/agent-service","severity":null,"published_at":"2026-11-05T14:41:37+00:00","modified_at":"2026-11-05T14:41:37+00:00","first_seen_at":"2026-11-05T14:41:37+00:00","fetched_at":"2026-11-05T14:41:37+00:00","note":"NVD says the fix PR awaits acceptance. Latest release is v2.0.11 (27 Oct), the affected one, so no fixed version. The docs (2.0.2/2.0.4) describe X-User-ID as a deliberate placeholder to override; this is by design. An open PR #3329 adds opt-in API-key auth middleware, but I could not confirm it is the CVE's fix PR, so it is not claimed. Nothing marked verified: no vendor advisory. No exploitation or PoC link found. Sibling CVE-2026-123022 is the same product.","cites":["https://docs.agentscope.io/en/versions/2.0.4/deploy/agent-service","https://github.com/agentscope-ai/agentscope/blob/89ce2cf6/src/agentscope/app/deps.py","https://github.com/agentscope-ai/agentscope/releases","https://github.com/agentscope-ai/agentscope/issues/2069"]}],"documents":[{"id":76981,"url":"https://docs.agentscope.io/en/versions/2.0.4/deploy/agent-service","title":"AgentScope Agent Service docs: X-User-ID is a placeholder, not authentication","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":76982,"url":"https://github.com/agentscope-ai/agentscope/blob/89ce2cf6/src/agentscope/app/deps.py","title":"agentscope deps.py get_current_user_id","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":76983,"url":"https://github.com/agentscope-ai/agentscope/releases","title":"agentscope releases (latest v2.0.11, 27 Oct)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":76984,"url":"https://github.com/agentscope-ai/agentscope/issues/2069","title":"Issue 2069: workspace add_skill source path; notes no HTTP auth, header identity","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}