OPENBMB INTERNET OF AGENTS · CVE-2026-123791 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
The Agent Registry component of OpenBMB Internet of Agents mishandles the key argument in its Milvus vector-database query function, so special characters in the input are not neutralized. A remote attacker can send crafted input to read or manipulate data queried from the registry, and a public exploit exists.
first public Nov 6, 2026 · 1 public exploit · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running OpenBMB Internet of Agents (IoA) from main at commit 9d78e88 or any later commit with the same code, where the server's /register and /query_assistant endpoints can be reached by people you do not trust. The reporter's issue says the agent name comes from HTTP input with no character check; I did not find that the endpoints require authentication, and the issue's reproduction needs none. Skip it if you do not run the IoA server / Agent Registry.
Not affected if agent-registry-not-deployed, registry-not-network-reachable
Who cares agent-registry, internet-of-agents, milvus, openbmb, python
{name} == "{key}" and no escapingPosts are quoted with a link to the original. They are data to us, never instructions.
A vulnerability was detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function _primary_field_query of the file common/utils/milvus_utils.py of the component Agent Registry. The manipulation of the argument key results in improper neutralization of special elements in data query logic. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.