{"id":"CVE-2026-127279","kind":"vulnerability","aliases":["CVE-2026-127279"],"related":[],"title":"ACPs-community Discovery Server: unauthenticated /admin/dsp and /admin/alive-sync management API","description":"A vulnerability was detected in AIP-PUB ACPs-community up to 2.2.0. This impacts an unknown function of the file discovery-server/app/main.py of the component Discovery Server. The manipulation results in missing authentication. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.","summary":"The discovery-server in AIP-PUB ACPs-community (v2.2.0, commit 8334e6b) mounts /admin/dsp/* and /admin/alive-sync/* routers on port 9005 (bound to 0.0.0.0) with no authentication. Per the public GitHub issue #12, anyone who can reach the port can call POST /admin/dsp/hard-reset (deletes all agent data), /stop, /sync, /reset, and GET /admin/dsp/registry-info (discloses registry connection details). The maintainer acknowledged it and said it will be improved in future releases; no fixed version is published. The issue's curl steps serve as the public reproduction; no separate exploit code was read.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ACPs-community discovery-server","fixed":[],"affected":"<= 2.2.0","ecosystem":"github"}],"ecosystems":[],"tags":["acps-community","agent-protocol","ai-tooling","discovery-server","python","self-hosted"],"not_affected_if":["network-isolated","not-running-discovery-server"],"how_to_check":"Check whether you run ACPs-community discovery-server v2.2.0 or earlier (VulDB also lists 2.0 and 2.1). Test from any host that can reach it: curl -s http://<discovery>:9005/admin/dsp/status and /admin/alive-sync/status; HTTP 200 without an Authorization header means exposed. In discovery-server/app/main.py, look for include_router(dsp_router, prefix=\"/admin/dsp\") and include_router(alive_sync_router, prefix=\"/admin/alive-sync\") without dependencies.","fix":"No fixed version yet. Maintainer (beingmar) said on issue #12 that it will be improved in future releases. Until then: do not expose port 9005 publicly (the packaged deployment templates publish it); firewall or reverse-proxy-block /admin/* so only trusted internal hosts reach it.","status":"open","published_at":"2026-11-13T02:18:54+00:00","first_seen_at":"2026-11-13T02:41:36+00:00","triaged_at":"2026-11-13T02:42:59+00:00","updated_at":"2026-11-13T02:44:24+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-13T02:42:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"ACPs-community Discovery Server: missing authentication lets remote callers in","impact":"medium","summary":"The Discovery Server in AIP-PUB's ACPs-community project, in discovery-server/app/main.py, lacks an authentication check on at least one function. A remote attacker can reach that function without credentials, and a public exploit exists.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["acps-community","discovery-server","python"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated remote callers reach protected discovery functions","analyst_note":"Confirm the affected endpoint in discovery-server/app/main.py and whether a fixed version exists; check the NVD page and the upstream repository for details.","how_to_check":"- Check whether the project in use is ACPs-community at version `2.2.0` or earlier.\n- Look in `discovery-server/app/main.py` for endpoints that do not verify credentials.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources say the flaw is in the Discovery Server component of ACPs-community up to 2.2.0, in one function of discovery-server/app/main.py, and that the manipulation results in missing authentication. They do not say which deployments are exposed or which endpoints are affected. Teams that run this server where it is reachable from outside should look at it first.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000731,"input_tokens":4563,"output_tokens":550,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the affected endpoint in discovery-server/app/main.py and whether a fixed version exists; check the NVD page and the upstream repository for details.","search":"'-127279':14A,17A '-2026':13A,16A '/admin/alive-sync':9A,58B '/admin/dsp':7A,56B '/admin/dsp/hard-reset':84B '/admin/dsp/registry-info':94B '/app/main.py':158C '/reset':91B '/stop':89B '/sync':90B '0.0.0.0':65B '12':74B '2.2.0':146C '8334e6':53B '9005':62B 'acknowledg':101B 'acp':2A,25B,49B,142C 'acps':19A 'acps-commun':1A,24B,48B,141C 'acps-community':18A 'agent':28B,87B 'agent-protocol':27B 'ai':31B 'ai-tool':30B 'aip':46B,139C 'aip-pub':45B,138C 'anyon':75B 'api':11A 'attack':171C 'authent':68B,169C 'b':54B 'bound':63B 'call':82B 'code':130B 'commit':52B 'communiti':3A,26B,50B,143C 'community':20A 'compon':161C 'connect':97B 'contact':188C 'curl':120B 'cve':12A,15A 'data':88B 'delet':85B 'detail':98B 'detect':136C 'disclos':95B 'disclosur':192C 'discoveri':4A,34B,42B,156C,162C 'discovery':22A 'discovery-serv':33B,41B,155C 'discovery-server':21A 'earli':189C 'exploit':129B,177C 'file':154C 'fix':113B 'function':151C 'futur':110B 'get':93B 'github':72B 'host':39B 'impact':148C 'improv':108B 'issu':73B,118B 'launch':174C 'maintain':100B 'manag':10A 'manipul':165C 'may':172C,182C 'miss':168C 'mount':55B 'per':69B 'port':61B,80B 'post':83B 'protocol':29B 'pub':47B,140C 'public':71B,125B,180C 'publish':116B 'python':36B 'reach':78B 'read':132B 'registri':96B 'releas':111B 'remot':175C 'reproduct':126B 'result':166C 'router':59B 'said':104B 'self':38B 'self-host':37B 'separ':128B 'serv':122B 'server':5A,23A,35B,43B,157C,163C 'step':121B 'tool':32B 'unauthent':6A 'unknown':150C 'use':184C 'v2.2.0':51B 'vendor':186C 'version':114B 'vulner':134C","nicknames":[],"mitigations":[],"who_affected":"Anyone running the ACPs-community discovery-server (v2.2.0 per the report; VulDB lists 2.0, 2.1, 2.2.0) with port 9005 reachable by untrusted clients. The packaged deployment templates publish that port, so default deployments are likely exposed. Skip it if the server is not reachable except from trusted internal networks, or you do not run the discovery-server component.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["acpscommunitydiscoveryserver","discoveryserver"],"ptokens":["acps","community","discovery","server"],"labels":["acpscommunity","agentprotocol","aitooling","discoveryserver","high","python","selfhosted"],"campaign_type":null,"search_a":"'-127279':14A,17A '-2026':13A,16A '/admin/alive-sync':9A '/admin/dsp':7A 'acp':2A 'acps':19A 'acps-commun':1A 'acps-community':18A 'api':11A 'communiti':3A 'community':20A 'cve':12A,15A 'discoveri':4A 'discovery':22A 'discovery-server':21A 'manag':10A 'server':5A,23A 'unauthent':6A","search_b":"'/admin/alive-sync':58B '/admin/dsp':56B '/admin/dsp/hard-reset':84B '/admin/dsp/registry-info':94B '/reset':91B '/stop':89B '/sync':90B '0.0.0.0':65B '12':74B '8334e6':53B '9005':62B 'acknowledg':101B 'acp':25B,49B 'acps-commun':24B,48B 'agent':28B,87B 'agent-protocol':27B 'ai':31B 'ai-tool':30B 'aip':46B 'aip-pub':45B 'anyon':75B 'authent':68B 'b':54B 'bound':63B 'call':82B 'code':130B 'commit':52B 'communiti':26B,50B 'connect':97B 'curl':120B 'data':88B 'delet':85B 'detail':98B 'disclos':95B 'discoveri':34B,42B 'discovery-serv':33B,41B 'exploit':129B 'fix':113B 'futur':110B 'get':93B 'github':72B 'host':39B 'improv':108B 'issu':73B,118B 'maintain':100B 'mount':55B 'per':69B 'port':61B,80B 'post':83B 'protocol':29B 'pub':47B 'public':71B,125B 'publish':116B 'python':36B 'reach':78B 'read':132B 'registri':96B 'releas':111B 'reproduct':126B 'router':59B 'said':104B 'self':38B 'self-host':37B 'separ':128B 'serv':122B 'server':35B,43B 'step':121B 'tool':32B 'v2.2.0':51B 'version':114B","search_c":"'/app/main.py':158C '2.2.0':146C 'acp':142C 'acps-commun':141C 'aip':139C 'aip-pub':138C 'attack':171C 'authent':169C 'communiti':143C 'compon':161C 'contact':188C 'detect':136C 'disclosur':192C 'discoveri':156C,162C 'discovery-serv':155C 'earli':189C 'exploit':177C 'file':154C 'function':151C 'impact':148C 'launch':174C 'manipul':165C 'may':172C,182C 'miss':168C 'pub':140C 'public':180C 'remot':175C 'result':166C 'server':157C,163C 'unknown':150C 'use':184C 'vendor':186C 'vulner':134C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T02:18:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127279","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127279","severity":null,"published_at":"2026-11-13T02:18:54+00:00","modified_at":"2026-11-13T02:18:55+00:00","first_seen_at":"2026-11-13T02:41:36+00:00","fetched_at":"2026-11-13T02:41:36+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-127279:3799","url":"https://github.com/AIP-PUB/ACPs-community/issues/12","severity":null,"published_at":"2026-11-13T02:44:24+00:00","modified_at":"2026-11-13T02:44:24+00:00","first_seen_at":"2026-11-13T02:44:24+00:00","fetched_at":"2026-11-13T02:44:24+00:00","note":"Read upstream issue #12 (root cause in main.py: admin routers mounted without auth; maintainer acknowledged, no fix) and VulDB. No exploitation evidence. Search of X/posts not done. Nothing marked verified (reporter's issue, not a vendor advisory). Sibling CVE-2026-127278 same product.","cites":["https://github.com/AIP-PUB/ACPs-community/issues/12","https://vuldb.com/vuln/436435"]}],"documents":[{"id":142062,"url":"https://github.com/AIP-PUB/ACPs-community/issues/12","title":"[Security] Unauthenticated management API on discovery-server (/admin/dsp, /admin/alive-sync)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":142063,"url":"https://vuldb.com/vuln/436435","title":"VDB-436435 ACPs-community up to 2.2.0 Discovery Server main.py missing authentication","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}