{"id":"CVE-2026-123881","kind":"vulnerability","aliases":["CVE-2026-123881"],"related":[],"title":"OpenBMB Internet of Agents: /fetch_chat_record returns chat records with no authentication, no fix yet","description":"A vulnerability was found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This issue affects the function fetch_chat_record of the file im_server/app.py of the component Message Handler. The manipulation of the argument comm_id results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The IoA im_server /fetch_chat_record endpoint has no authentication. The public issue OpenBMB/IoA#20 (opened 2026-10-14) shows that sending comm_id=null returns the whole chat database, and the code on main matches that. The project has not responded and no fix exists.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Internet of Agents (IoA)","fixed":[],"affected":"main at commit 9d78e88e47160eb42ee1ee8538c05e1c2c47877a and earlier (rolling release, no versions)","ecosystem":"github"}],"ecosystems":[],"tags":["ai-tooling","internet-of-agents","openbmb","python","self-hosted","unauthenticated"],"not_affected_if":["im_server-not-deployed","not-network-reachable"],"how_to_check":"- Check whether you run OpenBMB/IoA im_server (uvicorn on 0.0.0.0:7788) and whether port 7788 is reachable from untrusted networks.\n- Test: POST /fetch_chat_record with {\"comm_id\": null} and no credentials. If it returns JSON chat records, you are exposed.\n- Check your checkout: git log -1 (9d78e88 or any later commit without an auth check in fetch_chat_record is exposed; no fixed commit is known).","fix":null,"status":"open","published_at":"2026-11-07T08:16:26+00:00","first_seen_at":"2026-11-07T08:46:22+00:00","triaged_at":"2026-11-07T08:47:31+00:00","updated_at":"2026-11-07T08:48:59+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-07T08:47:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Internet of Agents: chat records readable through manipulated comm_id parameter","impact":"medium","summary":"OpenBMB Internet of Agents has an improper access control flaw in the fetch_chat_record function of im_server/app.py, where the comm_id argument is manipulated. A remote attacker can likely retrieve chat records they should not be able to see, and a public exploit exists.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["internet-of-agents","openbmb","python"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reads other users' chat records remotely","analyst_note":"Check the OpenBMB Internet of Agents repository for a fix or response and confirm whether fetch_chat_record requires authentication.","how_to_check":"- Check whether your deployment runs OpenBMB Internet of Agents and whether the im_server service is reachable from the network\n- Confirm the commit in use: unknown if the sources do not say which version is current","plain_action":"","needs_analyst":true,"not_affected_if":["im_server-not-deployed"],"who_is_affected":"The flaw is in the Message Handler component of the Internet of Agents im_server, exposed through the fetch_chat_record function, and the sources say the project has not yet responded. Teams running this server with network access to the chat endpoint should treat it as exposed. Teams that do not run the im_server component can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000706,"input_tokens":4296,"output_tokens":553,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the OpenBMB Internet of Agents repository for a fix or response and confirm whether fetch_chat_record requires authentication.","search":"'-10':54B '-123881':17A,20A '-14':55B '-2026':16A,19A '/fetch_chat_record':5A,42B '20':51B '2026':53B '9d78e88e47160eb42ee1ee8538c05e1c2c47877a':94C 'access':123C 'affect':97C 'agent':4A,31B,91C 'agents':23A 'ai':26B 'ai-tool':25B 'argument':117C 'attack':126C 'authent':11A,46B 'chat':7A,65B,101C 'code':69B 'comm':59B,118C 'compon':110C 'control':124C 'could':139C 'cve':15A,18A 'databas':66B 'earli':149C 'endpoint':43B 'exist':82B 'exploit':133C 'fetch':100C 'file':105C 'fix':13A,81B 'found':86C 'function':99C 'handler':112C 'host':36B 'id':60B,119C 'im':40B,106C 'improp':122C 'inform':145C 'internet':2A,21A,29B,89C 'internet-of-ag':28B 'ioa':24A,39B 'issu':49B,96C,152C 'made':136C 'main':71B 'manipul':114C 'match':72B 'may':127C 'messag':111C 'null':61B 'of':22A 'open':52B 'openbmb':1A,32B,88C 'openbmb/ioa':50B 'perform':129C 'problem':148C 'project':75B,143C 'public':48B,137C 'python':33B 'record':8A,102C 'remot':131C 'report':153C 'respond':78B,157C 'result':120C 'return':6A,62B 'self':35B 'self-host':34B 'send':58B 'server':41B 'server/app.py':107C 'show':56B 'tool':27B 'unauthent':37B 'use':141C 'vulner':84C 'whole':64B 'yet':14A,158C","nicknames":[],"mitigations":[],"who_affected":"Anyone running the OpenBMB Internet of Agents im_server, which listens on all interfaces on port 7788 with no authentication on /fetch_chat_record. Anyone who can reach that port can read the chat records of any session, and per the public issue, the entire chat database by sending a null comm_id. Those records hold team goals, plans, and tool outputs. Deployments that keep im_server on a private network or do not run it can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["internetofagentsioa","ofagentsioa"],"ptokens":["agents","internet","ioa","of"],"labels":["aitooling","high","internetofagents","openbmb","python","selfhosted","unauthenticated"],"campaign_type":null,"search_a":"'-123881':17A,20A '-2026':16A,19A '/fetch_chat_record':5A 'agent':4A 'agents':23A 'authent':11A 'chat':7A 'cve':15A,18A 'fix':13A 'internet':2A,21A 'ioa':24A 'of':22A 'openbmb':1A 'record':8A 'return':6A 'yet':14A","search_b":"'-10':54B '-14':55B '/fetch_chat_record':42B '20':51B '2026':53B 'agent':31B 'ai':26B 'ai-tool':25B 'authent':46B 'chat':65B 'code':69B 'comm':59B 'databas':66B 'endpoint':43B 'exist':82B 'fix':81B 'host':36B 'id':60B 'im':40B 'internet':29B 'internet-of-ag':28B 'ioa':39B 'issu':49B 'main':71B 'match':72B 'null':61B 'open':52B 'openbmb':32B 'openbmb/ioa':50B 'project':75B 'public':48B 'python':33B 'respond':78B 'return':62B 'self':35B 'self-host':34B 'send':58B 'server':41B 'show':56B 'tool':27B 'unauthent':37B 'whole':64B","search_c":"'9d78e88e47160eb42ee1ee8538c05e1c2c47877a':94C 'access':123C 'affect':97C 'agent':91C 'argument':117C 'attack':126C 'chat':101C 'comm':118C 'compon':110C 'control':124C 'could':139C 'earli':149C 'exploit':133C 'fetch':100C 'file':105C 'found':86C 'function':99C 'handler':112C 'id':119C 'im':106C 'improp':122C 'inform':145C 'internet':89C 'issu':96C,152C 'made':136C 'manipul':114C 'may':127C 'messag':111C 'openbmb':88C 'perform':129C 'problem':148C 'project':143C 'public':137C 'record':102C 'remot':131C 'report':153C 'respond':157C 'result':120C 'server/app.py':107C 'use':141C 'vulner':84C 'yet':158C","first_public_at":"2026-11-07T08:16:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123881","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123881","severity":null,"published_at":"2026-11-07T08:16:26+00:00","modified_at":"2026-11-07T08:16:27+00:00","first_seen_at":"2026-11-07T08:46:22+00:00","fetched_at":"2026-11-07T08:46:22+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123881:2090","url":"https://github.com/OpenBMB/IoA/issues/20","severity":null,"published_at":"2026-11-07T08:48:59+00:00","modified_at":"2026-11-07T08:48:59+00:00","first_seen_at":"2026-11-07T08:48:59+00:00","fetched_at":"2026-11-07T08:48:59+00:00","note":"Read issue #20 and main im_server/app.py: endpoint has no auth, comm_id None returns all records. Issue #20 doesn't say it's the same report as the CVE, but it names the same function and commit 9d78e88. Maintainers have not responded. No fix. Not verified: no vendor advisory.","cites":["https://github.com/OpenBMB/IoA/issues/20","https://github.com/OpenBMB/IoA/blob/main/im_server/app.py","https://nvd.nist.gov/vuln/detail/CVE-2026-123881"]}],"documents":[{"id":94291,"url":"https://github.com/OpenBMB/IoA/issues/20","title":"OpenBMB/IoA #20: Non-members can inject messages and read all chat records","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":94292,"url":"https://github.com/OpenBMB/IoA/blob/main/im_server/app.py","title":"OpenBMB/IoA im_server/app.py (main)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":94293,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123881","title":"NVD CVE-2026-123881","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}