---
id: "CVE-2026-123791"
page: "https://infrastack.ai/live/CVE-2026-123791"
kind: "vulnerability"
aliases: ["CVE-2026-123791"]
title: "OpenBMB IoA: agent names are put unescaped into Milvus queries, letting callers of /register and /query_assistant inject query logic"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "OpenBMB Internet of Agents", "fixed": [], "affected": "main up to and including 9d78e88e47160eb42ee1ee8538c05e1c2c47877a (rolling release, no versions)", "ecosystem": "github"}]
ecosystems: []
tags: ["agent-registry", "ai-tooling", "internet-of-agents", "milvus", "openbmb", "python"]
not_affected_if: ["agent-registry-not-deployed", "registry-not-network-reachable"]
published_at: "2026-11-06T22:17:50+00:00"
first_seen_at: "2026-11-06T22:44:32+00:00"
updated_at: "2026-11-06T22:46:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123791", "first_seen_at": "2026-11-06T22:44:32+00:00"}, {"source": "analyst", "url": "https://github.com/OpenBMB/IoA/blob/main/common/utils/milvus_utils.py", "first_seen_at": "2026-11-06T22:46:06+00:00", "cites": ["https://github.com/OpenBMB/IoA/blob/main/common/utils/milvus_utils.py", "https://github.com/OpenBMB/IoA/issues/19"]}]
exploit_sources: [{"type": "poc", "url": "https://github.com/OpenBMB/IoA/issues/19"}]
---

# OpenBMB IoA: agent names are put unescaped into Milvus queries, letting callers of /register and /query_assistant inject query logic

Link for people: https://infrastack.ai/live/CVE-2026-123791 (this .md is for agents)

The Agent Registry component of OpenBMB Internet of Agents mishandles the key argument in its Milvus vector-database query function, so special characters in the input are not neutralized. A remote attacker can send crafted input to read or manipulate data queried from the registry, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:OpenBMB Internet of Agents affected main up to and including 9d78e88e47160eb42ee1ee8538c05e1c2c47877a (rolling release, no versions) fixed no fixed version listed

## How to check

Check whether you run OpenBMB/IoA at or before commit 9d78e88 (git rev-parse HEAD) with the im_server exposed. In common/utils/milvus_utils.py, _primary_field_query builds the expression with f'{name} == "{key}"' and no escaping. Also check any other name-keyed query/delete path (remove) that uses the same interpolation. Test on a non-production instance: POST /query_assistant with a name containing a double quote, e.g. x" or key == "AutoGPT, and see if another record comes back.

## Fix

No fix: the issue (OpenBMB/IoA #19, opened 2026-10-14) is open with no maintainer response, and main still has the unescaped code. Until a fix exists: don't expose im_server /register and /query_assistant to untrusted callers, or put a filter in front that allows only names matching ^[A-Za-z0-9 _-]{1,64}$ (the reporter's suggestion). No fixed commit is known.

## Timeline

- 2026-11-06T22:44:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123791
- 2026-11-06T22:46:06+00:00 analyst https://github.com/OpenBMB/IoA/blob/main/common/utils/milvus_utils.py — Read reporter's issue #19 (repro: /register skipped silently, /query_assistant returns another agent's record) and main's milvus_utils.py, still unescaped. No fix or maintainer reply found. Nothing marked verified: only a third-party issue, not a vendor statement. Sibling CVE-2026-123675 and CVE-2026-123032 are same project. Auth on the endpoints not confirmed by vendor; exploit is the issue text.

## Documents

- [describes] IoA milvus_utils.py on main (_primary_field_query) https://github.com/OpenBMB/IoA/blob/main/common/utils/milvus_utils.py
- [poc] OpenBMB/IoA #19: Agent names concatenated into Milvus query expressions (expression injection) https://github.com/OpenBMB/IoA/issues/19

## From the sources

A vulnerability was detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function _primary_field_query of the file common/utils/milvus_utils.py of the component Agent Registry. The manipulation of the argument key results in improper neutralization of special elements in data query logic. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_