---
id: "CVE-2026-127279"
page: "https://infrastack.ai/live/CVE-2026-127279"
kind: "vulnerability"
aliases: ["CVE-2026-127279"]
title: "ACPs-community Discovery Server: unauthenticated /admin/dsp and /admin/alive-sync management API"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "ACPs-community discovery-server", "fixed": [], "affected": "<= 2.2.0", "ecosystem": "github"}]
ecosystems: []
tags: ["acps-community", "agent-protocol", "ai-tooling", "discovery-server", "python", "self-hosted"]
not_affected_if: ["network-isolated", "not-running-discovery-server"]
published_at: "2026-11-13T02:18:54+00:00"
first_seen_at: "2026-11-13T02:41:36+00:00"
updated_at: "2026-11-13T02:44:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127279", "first_seen_at": "2026-11-13T02:41:36+00:00"}, {"source": "analyst", "url": "https://github.com/AIP-PUB/ACPs-community/issues/12", "first_seen_at": "2026-11-13T02:44:24+00:00", "cites": ["https://github.com/AIP-PUB/ACPs-community/issues/12", "https://vuldb.com/vuln/436435"]}]
exploit_sources: []
---

# ACPs-community Discovery Server: unauthenticated /admin/dsp and /admin/alive-sync management API

Link for people: https://infrastack.ai/live/CVE-2026-127279 (this .md is for agents)

The discovery-server in AIP-PUB ACPs-community (v2.2.0, commit 8334e6b) mounts /admin/dsp/* and /admin/alive-sync/* routers on port 9005 (bound to 0.0.0.0) with no authentication. Per the public GitHub issue #12, anyone who can reach the port can call POST /admin/dsp/hard-reset (deletes all agent data), /stop, /sync, /reset, and GET /admin/dsp/registry-info (discloses registry connection details). The maintainer acknowledged it and said it will be improved in future releases; no fixed version is published. The issue's curl steps serve as the public reproduction; no separate exploit code was read.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:ACPs-community discovery-server affected <= 2.2.0 fixed no fixed version listed

## How to check

Check whether you run ACPs-community discovery-server v2.2.0 or earlier (VulDB also lists 2.0 and 2.1). Test from any host that can reach it: curl -s http://<discovery>:9005/admin/dsp/status and /admin/alive-sync/status; HTTP 200 without an Authorization header means exposed. In discovery-server/app/main.py, look for include_router(dsp_router, prefix="/admin/dsp") and include_router(alive_sync_router, prefix="/admin/alive-sync") without dependencies.

## Fix

No fixed version yet. Maintainer (beingmar) said on issue #12 that it will be improved in future releases. Until then: do not expose port 9005 publicly (the packaged deployment templates publish it); firewall or reverse-proxy-block /admin/* so only trusted internal hosts reach it.

## Timeline

- 2026-11-13T02:41:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127279
- 2026-11-13T02:44:24+00:00 analyst https://github.com/AIP-PUB/ACPs-community/issues/12 — Read upstream issue #12 (root cause in main.py: admin routers mounted without auth; maintainer acknowledged, no fix) and VulDB. No exploitation evidence. Search of X/posts not done. Nothing marked verified (reporter's issue, not a vendor advisory). Sibling CVE-2026-127278 same product.

## Documents

- [advisory] [Security] Unauthenticated management API on discovery-server (/admin/dsp, /admin/alive-sync) https://github.com/AIP-PUB/ACPs-community/issues/12
- [mentions] VDB-436435 ACPs-community up to 2.2.0 Discovery Server main.py missing authentication https://vuldb.com/vuln/436435

## From the sources

A vulnerability was detected in AIP-PUB ACPs-community up to 2.2.0. This impacts an unknown function of the file discovery-server/app/main.py of the component Discovery Server. The manipulation results in missing authentication. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_