INTERNET OF AGENTS (IOA) · CVE-2026-123881 · AI agents & MCP
NO FIX YET
The IoA im_server /fetch_chat_record endpoint has no authentication. The public issue OpenBMB/IoA#20 (opened 2026-10-14) shows that sending comm_id=null returns the whole chat database, and the code on main matches that. The project has not responded and no fix exists.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Anyone running the OpenBMB Internet of Agents im_server, which listens on all interfaces on port 7788 with no authentication on /fetch_chat_record. Anyone who can reach that port can read the chat records of any session, and per the public issue, the entire chat database by sending a null comm_id. Those records hold team goals, plans, and tool outputs. Deployments that keep im_server on a private network or do not run it can skip this.
Not affected if im_server-not-deployed, not-network-reachable
Who cares internet-of-agents, openbmb, python, self-hosted, unauthenticated
No fix yet, per the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
A vulnerability was found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This issue affects the function fetch_chat_record of the file im_server/app.py of the component Message Handler. The manipulation of the argument comm_id results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.