{"id":"CVE-2026-123791","kind":"vulnerability","aliases":["CVE-2026-123791"],"related":[],"title":"OpenBMB IoA: agent names are put unescaped into Milvus queries, letting callers of /register and /query_assistant inject query logic","description":"A vulnerability was detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function _primary_field_query of the file common/utils/milvus_utils.py of the component Agent Registry. The manipulation of the argument key results in improper neutralization of special elements in data query logic. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The Agent Registry component of OpenBMB Internet of Agents mishandles the key argument in its Milvus vector-database query function, so special characters in the input are not neutralized. A remote attacker can send crafted input to read or manipulate data queried from the registry, and a public exploit exists.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OpenBMB Internet of Agents","fixed":[],"affected":"main up to and including 9d78e88e47160eb42ee1ee8538c05e1c2c47877a (rolling release, no versions)","ecosystem":"github"}],"ecosystems":[],"tags":["agent-registry","ai-tooling","internet-of-agents","milvus","openbmb","python"],"not_affected_if":["agent-registry-not-deployed","registry-not-network-reachable"],"how_to_check":"Check whether you run OpenBMB/IoA at or before commit 9d78e88 (git rev-parse HEAD) with the im_server exposed. In common/utils/milvus_utils.py, _primary_field_query builds the expression with f'{name} == \"{key}\"' and no escaping. Also check any other name-keyed query/delete path (remove) that uses the same interpolation. Test on a non-production instance: POST /query_assistant with a name containing a double quote, e.g. x\" or key == \"AutoGPT, and see if another record comes back.","fix":"No fix: the issue (OpenBMB/IoA #19, opened 2026-10-14) is open with no maintainer response, and main still has the unescaped code. Until a fix exists: don't expose im_server /register and /query_assistant to untrusted callers, or put a filter in front that allows only names matching ^[A-Za-z0-9 _-]{1,64}$ (the reporter's suggestion). No fixed commit is known.","status":"open","published_at":"2026-11-06T22:17:50+00:00","first_seen_at":"2026-11-06T22:44:32+00:00","triaged_at":"2026-11-06T22:44:47+00:00","updated_at":"2026-11-06T22:46:06+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-06T22:44:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"OpenBMB Internet of Agents: Agent Registry query flaw lets remote users inject data queries","impact":"medium","summary":"The Agent Registry component of OpenBMB Internet of Agents mishandles the key argument in its Milvus vector-database query function, so special characters in the input are not neutralized. A remote attacker can send crafted input to read or manipulate data queried from the registry, and a public exploit exists.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["openbmb","internet-of-agents","agent-registry","milvus","python"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote query manipulation exposes registry data; code execution unconfirmed","analyst_note":"Confirm whether the Agent Registry query path is reachable unauthenticated and whether any upstream fix exists; the NVD entry lists no version or fix details.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["agent-registry-not-deployed"],"who_is_affected":"Teams running OpenBMB Internet of Agents with the Agent Registry component, which uses Milvus for queries in common/utils/milvus_utils.py, up to commit 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. The product is a rolling release with no version details, so exposure depends on the commit deployed. Installations that do not run the Agent Registry are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000719,"input_tokens":4352,"output_tokens":567,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether the Agent Registry query path is reachable unauthenticated and whether any upstream fix exists; the NVD entry lists no version or fix details.","search":"'-123791':22A,25A '-2026':21A,24A '/query_assistant':16A '/register':14A '9d78e88e47160eb42ee1ee8538c05e1c2c47877a':105C 'affect':107C,173C 'agent':3A,31B,39B,44B,51B,102C,120C 'agent-registri':30B 'agents':29A 'ai':34B 'ai-tool':33B 'argument':55B,126C 'attack':75B,140C 'basi':161C 'caller':12A 'charact':66B 'common/utils/milvus_utils.py':116C 'compon':46B,119C 'consequ':165C 'continu':163C 'craft':78B 'cve':20A,23A 'data':84B,136C 'databas':61B 'deliveri':164C 'detail':170C 'detect':97C 'earli':184C 'either':172C 'element':134C 'ensur':162C 'exist':93B 'exploit':92B,146C 'field':111C 'file':115C 'function':63B,109C 'improp':130C 'inform':180C 'inject':17A 'input':69B,79B 'internet':27A,37B,49B,100C 'internet-of-ag':36B 'ioa':2A 'issu':187C 'key':54B,127C 'launch':143C 'let':11A 'logic':19A,138C 'manipul':83B,123C 'may':141C,151C 'milvus':9A,40B,58B 'mishandl':52B 'name':4A 'neutral':72B,131C 'of':28A 'openbmb':1A,26A,41B,48B,99C 'oper':156C 'primari':110C 'problem':183C 'product':155C 'project':178C 'public':91B,149C 'put':6A 'python':42B 'queri':10A,18A,62B,85B,112C,137C 'read':81B 'registri':32B,45B,88B,121C 'releas':160C,176C 'remot':74B,144C 'report':188C 'respond':192C 'result':128C 'roll':159C 'send':77B 'special':65B,133C 'tool':35B 'unescap':7A 'updat':175C 'use':153C 'vector':60B 'vector-databas':59B 'version':169C 'vulner':95C 'yet':193C","nicknames":[],"mitigations":[],"who_affected":"Teams running OpenBMB Internet of Agents (IoA) from main at commit 9d78e88 or any later commit with the same code, where the server's /register and /query_assistant endpoints can be reached by people you do not trust. The reporter's issue says the agent name comes from HTTP input with no character check; I did not find that the endpoints require authentication, and the issue's reproduction needs none. Skip it if you do not run the IoA server / Agent Registry.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["internetofagents","openbmbinternetofagents"],"ptokens":["agents","internet","of","openbmb"],"labels":["agentregistry","aitooling","high","internetofagents","milvus","openbmb","python"],"campaign_type":null,"search_a":"'-123791':22A,25A '-2026':21A,24A '/query_assistant':16A '/register':14A 'agent':3A 'agents':29A 'caller':12A 'cve':20A,23A 'inject':17A 'internet':27A 'ioa':2A 'let':11A 'logic':19A 'milvus':9A 'name':4A 'of':28A 'openbmb':1A,26A 'put':6A 'queri':10A,18A 'unescap':7A","search_b":"'agent':31B,39B,44B,51B 'agent-registri':30B 'ai':34B 'ai-tool':33B 'argument':55B 'attack':75B 'charact':66B 'compon':46B 'craft':78B 'data':84B 'databas':61B 'exist':93B 'exploit':92B 'function':63B 'input':69B,79B 'internet':37B,49B 'internet-of-ag':36B 'key':54B 'manipul':83B 'milvus':40B,58B 'mishandl':52B 'neutral':72B 'openbmb':41B,48B 'public':91B 'python':42B 'queri':62B,85B 'read':81B 'registri':32B,45B,88B 'remot':74B 'send':77B 'special':65B 'tool':35B 'vector':60B 'vector-databas':59B","search_c":"'9d78e88e47160eb42ee1ee8538c05e1c2c47877a':105C 'affect':107C,173C 'agent':102C,120C 'argument':126C 'attack':140C 'basi':161C 'common/utils/milvus_utils.py':116C 'compon':119C 'consequ':165C 'continu':163C 'data':136C 'deliveri':164C 'detail':170C 'detect':97C 'earli':184C 'either':172C 'element':134C 'ensur':162C 'exploit':146C 'field':111C 'file':115C 'function':109C 'improp':130C 'inform':180C 'internet':100C 'issu':187C 'key':127C 'launch':143C 'logic':138C 'manipul':123C 'may':141C,151C 'neutral':131C 'openbmb':99C 'oper':156C 'primari':110C 'problem':183C 'product':155C 'project':178C 'public':149C 'queri':112C,137C 'registri':121C 'releas':160C,176C 'remot':144C 'report':188C 'respond':192C 'result':128C 'roll':159C 'special':133C 'updat':175C 'use':153C 'version':169C 'vulner':95C 'yet':193C","first_public_at":"2026-11-06T22:17:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-123791","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123791","severity":null,"published_at":"2026-11-06T22:17:50+00:00","modified_at":"2026-11-06T22:17:51+00:00","first_seen_at":"2026-11-06T22:44:32+00:00","fetched_at":"2026-11-06T22:44:32+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123791:1935","url":"https://github.com/OpenBMB/IoA/issues/19","severity":null,"published_at":"2026-11-06T22:46:06+00:00","modified_at":"2026-11-06T22:46:06+00:00","first_seen_at":"2026-11-06T22:46:06+00:00","fetched_at":"2026-11-06T22:46:06+00:00","note":"Read reporter's issue #19 (repro: /register skipped silently, /query_assistant returns another agent's record) and main's milvus_utils.py, still unescaped. No fix or maintainer reply found. Nothing marked verified: only a third-party issue, not a vendor statement. Sibling CVE-2026-123675 and CVE-2026-123032 are same project. Auth on the endpoints not confirmed by vendor; exploit is the issue text.","cites":["https://github.com/OpenBMB/IoA/issues/19","https://github.com/OpenBMB/IoA/blob/main/common/utils/milvus_utils.py"]}],"documents":[{"id":90805,"url":"https://github.com/OpenBMB/IoA/issues/19","title":"OpenBMB/IoA #19: Agent names concatenated into Milvus query expressions (expression injection)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":90806,"url":"https://github.com/OpenBMB/IoA/blob/main/common/utils/milvus_utils.py","title":"IoA milvus_utils.py on main (_primary_field_query)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[{"type":"poc","url":"https://github.com/OpenBMB/IoA/issues/19"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}