{"id":"CVE-2026-123964","kind":"vulnerability","aliases":["CVE-2026-123964"],"related":[],"title":"Internet of Agents: launch_goal has no turn cap or timeout, so a silent team member hangs a task forever","description":"A vulnerability was detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function launch_goal of the file im_client/communication/communication_layer.py of the component Collaboration Layer. Performing a manipulation of the argument max_turns results in infinite loop. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.","summary":"In OpenBMB IoA (main at commit 9d78e88), LaunchGoalParam.max_turns defaults to None and is not validated. Reaching max_turns only adds a prompt asking the model to conclude. launch_goal then polls for a conclusion in a while True loop with no timeout. The reporter says a team member that never sends a CONCLUSION message keeps /launch_goal from returning while LLM tokens and compute are used. In their live test, with max_turns=1 there was no response after 240 seconds.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OpenBMB/IoA","fixed":[],"affected":"<= 9d78e88e47160eb42ee1ee8538c05e1c2c47877a (rolling release, no versions)","ecosystem":"github"}],"ecosystems":[],"tags":["ai-agents","ai-tooling","denial-of-service","internet-of-agents","openbmb","python"],"not_affected_if":["no-remote-access","not-deployed","trusted-agents-only"],"how_to_check":"- Check whether you run OpenBMB/IoA at or before commit 9d78e88e47160eb42ee1ee8538c05e1c2c47877a (git rev-parse HEAD)\n- In im_client/communication/communication_layer.py, look for the while True conclusion poll with asyncio.sleep(5) in launch_goal and no timeout; max_turns defaults to None in common/types/communication.py\n- Check whether the /launch_goal port (5050 in the docs) and agent registration are reachable by anyone you do not trust","fix":"No fix or patched commit as of 2026-11-07: issue #22 is open with no maintainer reply. Workaround: put your own timeout around /launch_goal calls and only let trusted agents join teams.","status":"open","published_at":"2026-11-07T13:16:38+00:00","first_seen_at":"2026-11-07T13:47:26+00:00","triaged_at":"2026-11-07T13:49:35+00:00","updated_at":"2026-11-07T13:50:41+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-07T13:49:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Internet of Agents: crafted max_turns argument makes launch_goal loop forever","impact":"low","summary":"OpenBMB Internet of Agents has a flaw in its launch_goal function where a manipulated max_turns argument sends the process into an infinite loop. An attacker who can reach the collaboration layer remotely can tie up the service, causing denial of service.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["internet-of-agents","openbmb","python","ai-agents"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Service hangs in an infinite loop, causing denial of service","analyst_note":"Confirm whether the project has released a fix or patched commit; the sources say the project has not responded to the issue report.","how_to_check":"- Check whether the deployment runs OpenBMB Internet of Agents at or before commit `9d78e88e47160eb42ee1ee8538c05e1c2c47877a`\n- Look for `launch_goal` in `im_client/communication/communication_layer.py` and check whether `max_turns` is validated\n- Confirm whether the collaboration layer is reachable from outside your network","plain_action":"","needs_analyst":true,"not_affected_if":["not-deployed","no-remote-access"],"who_is_affected":"Teams that run OpenBMB Internet of Agents and expose the Collaboration Layer to a network the attacker can reach. The sources say the product uses a rolling release model with no version data, so the affected range is given only as a commit. Teams that do not run this project can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000736,"input_tokens":4347,"output_tokens":603,"severity_before":"medium"},"analyst_status":"done","analyst_note":"Confirm whether the project has released a fix or patched commit; the sources say the project has not responded to the issue report.","search":"'-123964':23A,26A '-2026':22A,25A '/launch_goal':100B '1':117B '240':123B '9d78e88':50B '9d78e88e47160eb42ee1ee8538c05e1c2c47877a':136C 'add':64B 'affect':138C,198C 'agent':3A,30B,41B,133C 'ai':29B,32B 'ai-ag':28B 'ai-tool':31B 'argument':158C 'ask':67B 'attack':166C 'avail':204C 'cap':9A 'client/communication/communication_layer.py':147C 'collabor':151C 'commit':49B 'compon':150C 'comput':107B 'conclud':71B 'conclus':78B,97B 'continu':189C 'cve':21A,24A 'default':53B 'deliv':188C 'denial':35B 'denial-of-servic':34B 'detect':128C 'earli':212C 'exploit':172C 'file':145C 'forev':20A 'function':140C 'goal':5A,73B,142C 'hang':17A 'im':146C 'infinit':163C 'inform':196C,208C 'initi':169C 'internet':1A,39B,131C 'internet-of-ag':38B 'ioa':46B 'issu':215C 'keep':99B 'launch':4A,72B,141C 'launchgoalparam.max':51B 'layer':152C 'live':112B 'llm':104B 'loop':83B,164C 'main':47B 'manipul':155C 'max':61B,115B,159C 'may':167C,177C 'member':16A,92B 'messag':98B 'model':69B,186C 'never':94B 'none':55B 'openbmb':42B,45B,130C 'openbmb/ioa':27A 'perform':153C 'poll':75B 'problem':211C 'product':181C 'project':206C 'prompt':66B 'public':175C 'python':43B 'reach':60B 'releas':185C,201C 'remot':170C 'report':88B,216C 'respond':220C 'respons':121B 'result':161C,193C 'return':102B 'roll':184C 'say':89B 'second':124B 'send':95B 'servic':37B 'silent':14A 'specif':194C 'task':19A 'team':15A,91B 'test':113B 'timeout':11A,86B 'token':105B 'tool':33B 'true':82B 'turn':8A,52B,62B,116B,160C 'updat':190C,200C 'use':109B,179C,182C 'valid':59B 'version':195C 'vulner':126C 'yet':221C","nicknames":[],"mitigations":[],"who_affected":"Teams that run OpenBMB Internet of Agents (commit 9d78e88 and, as the project is rolling-release, likely later main until fixed) and let untrusted or unreliable agents join their teams or call /launch_goal. An unresponsive or malicious member can leave a goal running indefinitely and burn LLM tokens. Teams that do not run IoA, or run it only locally with trusted agents, can mostly skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["openbmbioa"],"ptokens":["ioa","openbmb"],"labels":["aiagents","aitooling","denialofservice","internetofagents","medium","openbmb","python"],"campaign_type":null,"search_a":"'-123964':23A,26A '-2026':22A,25A 'agent':3A 'cap':9A 'cve':21A,24A 'forev':20A 'goal':5A 'hang':17A 'internet':1A 'launch':4A 'member':16A 'openbmb/ioa':27A 'silent':14A 'task':19A 'team':15A 'timeout':11A 'turn':8A","search_b":"'/launch_goal':100B '1':117B '240':123B '9d78e88':50B 'add':64B 'agent':30B,41B 'ai':29B,32B 'ai-ag':28B 'ai-tool':31B 'ask':67B 'commit':49B 'comput':107B 'conclud':71B 'conclus':78B,97B 'default':53B 'denial':35B 'denial-of-servic':34B 'goal':73B 'internet':39B 'internet-of-ag':38B 'ioa':46B 'keep':99B 'launch':72B 'launchgoalparam.max':51B 'live':112B 'llm':104B 'loop':83B 'main':47B 'max':61B,115B 'member':92B 'messag':98B 'model':69B 'never':94B 'none':55B 'openbmb':42B,45B 'poll':75B 'prompt':66B 'python':43B 'reach':60B 'report':88B 'respons':121B 'return':102B 'say':89B 'second':124B 'send':95B 'servic':37B 'team':91B 'test':113B 'timeout':86B 'token':105B 'tool':33B 'true':82B 'turn':52B,62B,116B 'use':109B 'valid':59B","search_c":"'9d78e88e47160eb42ee1ee8538c05e1c2c47877a':136C 'affect':138C,198C 'agent':133C 'argument':158C 'attack':166C 'avail':204C 'client/communication/communication_layer.py':147C 'collabor':151C 'compon':150C 'continu':189C 'deliv':188C 'detect':128C 'earli':212C 'exploit':172C 'file':145C 'function':140C 'goal':142C 'im':146C 'infinit':163C 'inform':196C,208C 'initi':169C 'internet':131C 'issu':215C 'launch':141C 'layer':152C 'loop':164C 'manipul':155C 'max':159C 'may':167C,177C 'model':186C 'openbmb':130C 'perform':153C 'problem':211C 'product':181C 'project':206C 'public':175C 'releas':185C,201C 'remot':170C 'report':216C 'respond':220C 'result':161C,193C 'roll':184C 'specif':194C 'turn':160C 'updat':190C,200C 'use':179C,182C 'version':195C 'vulner':126C 'yet':221C","first_public_at":"2026-11-07T13:16:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123964","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123964","severity":null,"published_at":"2026-11-07T13:16:38+00:00","modified_at":"2026-11-07T13:16:38+00:00","first_seen_at":"2026-11-07T13:47:26+00:00","fetched_at":"2026-11-07T13:47:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123964:2123","url":"https://github.com/OpenBMB/IoA/issues/22","severity":null,"published_at":"2026-11-07T13:50:41+00:00","modified_at":"2026-11-07T13:50:41+00:00","first_seen_at":"2026-11-07T13:50:41+00:00","fetched_at":"2026-11-07T13:50:41+00:00","note":"Primary source is the researcher's issue OpenBMB/IoA#22 (open, no maintainer response) and VulDB submit. Not a crafted-argument bug as titled: unbounded default max_turns plus a no-timeout poll; trigger is a silent team member. Retitled. No fix found; no PoC beyond the issue steps; nothing verified because no vendor/maintainer page.","cites":["https://github.com/OpenBMB/IoA/issues/22","https://vuldb.com/submit/1033798"]}],"documents":[{"id":95880,"url":"https://github.com/OpenBMB/IoA/issues/22","title":"OpenBMB/IoA #22: No hard cap on collaboration turns or conclusion polling","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":95881,"url":"https://vuldb.com/submit/1033798","title":"VulDB submit #1033798 (Excessive Iteration, IoA 9d78e88)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}