---
id: "CVE-2026-123024"
kind: "vulnerability"
aliases: ["CVE-2026-123024"]
title: "AgentScope: missing authentication in user ID header lets remote callers act as any user"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "agentscope", "fixed": [], "affected": "<= 2.0.11", "ecosystem": "pypi"}]
ecosystems: []
tags: ["agent-service", "agentscope", "ai-tooling", "python", "self-hosted"]
not_affected_if: ["auth-required", "custom-auth-dependency", "internal-only-network"]
published_at: "2026-11-05T14:17:04+00:00"
first_seen_at: "2026-11-05T14:39:18+00:00"
updated_at: "2026-11-05T14:41:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123024", "first_seen_at": "2026-11-05T14:39:18+00:00"}, {"source": "analyst", "url": "https://docs.agentscope.io/en/versions/2.0.4/deploy/agent-service", "first_seen_at": "2026-11-05T14:41:37+00:00", "cites": ["https://docs.agentscope.io/en/versions/2.0.4/deploy/agent-service", "https://github.com/agentscope-ai/agentscope/blob/89ce2cf6/src/agentscope/app/deps.py", "https://github.com/agentscope-ai/agentscope/releases", "https://github.com/agentscope-ai/agentscope/issues/2069"]}]
exploit_sources: []
---

# AgentScope: missing authentication in user ID header lets remote callers act as any user

AgentScope, an agent framework from agentscope-ai, up to version 2.0.11 trusts the X-User-ID request header in its Agent Service without checking authentication. A remote attacker can send a crafted header to act as another user.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:agentscope affected <= 2.0.11 fixed no fixed version listed

## How to check

- Run `pip show agentscope`; 2.0.11 or earlier is in range, and no fixed release exists yet.
- Check whether your app uses the stock `get_current_user_id` in src/agentscope/app/deps.py (reads X-User-ID with no credential check) or overrides it with your own JWT/OAuth dependency.
- Check whether the Agent Service port (examples bind 0.0.0.0:8000) is reachable from untrusted networks. Test: `curl -H 'X-User-ID: someone' http://HOST:8000/...` returning data means anyone can pick an identity.

## Timeline

- 2026-11-05T14:39:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123024
- 2026-11-05T14:41:37+00:00 analyst https://docs.agentscope.io/en/versions/2.0.4/deploy/agent-service — NVD says the fix PR awaits acceptance. Latest release is v2.0.11 (27 Oct), the affected one, so no fixed version. The docs (2.0.2/2.0.4) describe X-User-ID as a deliberate placeholder to override; this is by design. An open PR #3329 adds opt-in API-key auth middleware, but I could not confirm it is the CVE's fix PR, so it is not claimed. Nothing marked verified: no vendor advisory. No exploitation or PoC link found. Sibling CVE-2026-123022 is the same product.

## Documents

- [advisory] AgentScope Agent Service docs: X-User-ID is a placeholder, not authentication https://docs.agentscope.io/en/versions/2.0.4/deploy/agent-service
- [describes] agentscope deps.py get_current_user_id https://github.com/agentscope-ai/agentscope/blob/89ce2cf6/src/agentscope/app/deps.py
- [fix] agentscope releases (latest v2.0.11, 27 Oct) https://github.com/agentscope-ai/agentscope/releases
- [mentions] Issue 2069: workspace add_skill source path; notes no HTTP auth, header identity https://github.com/agentscope-ai/agentscope/issues/2069

## From the sources

A vulnerability has been found in agentscope-ai AgentScope up to 2.0.11. This impacts the function get_current_user_id of the file src/agentscope/app/deps.py of the component Agent Service. Such manipulation of the argument X-User-ID leads to missing authentication. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_