ACPS-COMMUNITY DISCOVERY-SERVER · CVE-2026-127279 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
The discovery-server in AIP-PUB ACPs-community (v2.2.0, commit 8334e6b) mounts /admin/dsp/* and /admin/alive-sync/* routers on port 9005 (bound to 0.0.0.0) with no authentication. Per the public GitHub issue #12, anyone who can reach the port can call POST /admin/dsp/hard-reset (deletes all agent data), /stop, /sync, /reset, and GET /admin/dsp/registry-info (discloses registry connection details). The maintainer acknowledged it and said it will be improved in future releases; no fixed version is published. The issue's curl steps serve as the public reproduction; no separate exploit code was read.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Anyone running the ACPs-community discovery-server (v2.2.0 per the report; VulDB lists 2.0, 2.1, 2.2.0) with port 9005 reachable by untrusted clients. The packaged deployment templates publish that port, so default deployments are likely exposed. Skip it if the server is not reachable except from trusted internal networks, or you do not run the discovery-server component.
Not affected if network-isolated, not-running-discovery-server
Who cares acps-community, agent-protocol, discovery-server, python, self-hosted
v2.2.0 or earlier (VulDB also lists 2.0 and 2.1)curl -s http://<discovery>:9005/admin/dsp/status and /admin/alive-sync/status; HTTP 200 without an Authorization header means exposedA vulnerability was detected in AIP-PUB ACPs-community up to 2.2.0. This impacts an unknown function of the file discovery-server/app/main.py of the component Discovery Server. The manipulation results in missing authentication. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.