---
id: "CVE-2026-123963"
page: "https://infrastack.ai/live/CVE-2026-123963"
kind: "vulnerability"
aliases: ["CVE-2026-123963"]
title: "OpenBMB Internet of Agents: Agent Registry accepts registrations without authentication"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "OpenBMB/IoA", "fixed": [], "affected": "<= 9d78e88e47160eb42ee1ee8538c05e1c2c47877a (no versioning)", "ecosystem": "github"}]
ecosystems: []
tags: ["agent-registry", "ai-tooling", "internet-of-agents", "openbmb", "python"]
not_affected_if: ["private-network", "registry-not-exposed"]
published_at: "2026-11-07T13:16:38+00:00"
first_seen_at: "2026-11-07T13:47:26+00:00"
updated_at: "2026-11-07T13:51:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123963", "first_seen_at": "2026-11-07T13:47:26+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123963", "first_seen_at": "2026-11-07T13:51:01+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-123963"]}]
exploit_sources: []
---

# OpenBMB Internet of Agents: Agent Registry accepts registrations without authentication

Link for people: https://infrastack.ai/live/CVE-2026-123963 (this .md is for agents)

The Agent Registry component of OpenBMB Internet of Agents, in im_server/app.py, has a register function that accepts desc and name arguments without requiring authentication. A remote attacker can abuse it, and the exploit has been published.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:OpenBMB/IoA affected <= 9d78e88e47160eb42ee1ee8538c05e1c2c47877a (no versioning) fixed no fixed version listed

## How to check

- Find the commit your IoA server runs (git rev-parse HEAD in your clone, or the weize/ioa-server image build). Commit 9d78e88e47160eb42ee1ee8538c05e1c2c47877a and earlier are reported affected; the project has no versions.
- Open im_server/app.py and check whether the register function checks any token or credential before accepting desc and name.
- From outside your trusted network, test whether the registry /register endpoint answers; if it does, anyone can register agents.
- Also check if you run the sibling IoA issues (WebSocket /ws/{agent_name}, Milvus query injection), reported on the same commit.

## Fix

No fix: the project is on rolling releases, has not responded to the issue reports, and publishes no patched commit. Until it does: do not expose the IoA server (im_server, Agent Registry /register) to untrusted networks, or put an authenticating reverse proxy in front of it.

## Timeline

- 2026-11-07T13:47:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123963
- 2026-11-07T13:51:01+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-123963 — NVD/VulDB text only; no fix. Repo OpenBMB/IoA has open security issues (#17-#22, filed 2026-10-14, no maintainer response, no SECURITY.md); the exact issue for register is not confirmed (closest: #21 /register no rate limiting or input validation). No PoC link found, so exploited stays false. Sibling CVEs on same commit: CVE-2026-123032, -123881, -123791. Nothing verified: no vendor advisory exists.

## Documents

- [advisory] NVD CVE-2026-123963 https://nvd.nist.gov/vuln/detail/CVE-2026-123963
- [discussion] OpenBMB/IoA issues (security reports #17-#22, no maintainer response) https://github.com/OpenBMB/IoA/issues

## From the sources

A security vulnerability has been detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. The impacted element is the function register of the file im_server/app.py of the component Agent Registry. Such manipulation of the argument desc/name leads to missing authentication. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_