CVE-2026-123791: OpenBMB Internet of Agents expression injection in agent registry

CVE-2026-123791 · Severity: high · CVSS 7.3 · Published 2026-11-06

OpenBMB Internet of Agents is a platform for deploying and managing autonomous agents. An attacker can inject malicious query expressions into the agent registration system by sending specially crafted agent names, allowing them to bypass registration checks, retrieve data about other agents, or manipulate the agent registry without authentication. The vulnerability affects the core registry mechanism and is remotely exploitable.

Technologies: OpenBMB Internet of Agents. Vendors: OpenBMB.

Quick answers

Is CVE-2026-123791 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-123791 being exploited in the wild.
How severe is CVE-2026-123791?
High severity, with a CVSS score of 7.3, published 6 November 2026.
Which products and versions are affected?
OpenBMB Internet of Agents up to commit 9d78e88e47160eb42ee1ee8538c05e1c2c47877a.
Is there a fix for CVE-2026-123791?
No fixed version is recorded yet. Validate agent names against a strict character allowlist (e.g., ^[A-Za-z0-9 _-]{1,64}$) at the API layer before any query or storage operation. Implement parameterized queries or proper escaping of special characters in Milvus expressions instead of string interpolation.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-123791 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-123791?
Check whether you run OpenBMB Internet of Agents at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Validate agent names against a strict character allowlist (e.g., ^[A-Za-z0-9 _-]{1,64}$) at the API layer before any query or storage operation. Implement parameterized queries or proper escaping of special characters in Milvus expressions instead of string interpolation.</anigation> </invoke>

Technical details

The _primary_field_query function in common/utils/milvus_utils.py constructs Milvus database query expressions by directly concatenating unsanitized agent names from HTTP input into SQL-like expression strings. An attacker can inject a double quote followed by boolean operators (e.g., `" or key == "AutoGPT`) to alter query logic, bypass existence checks, or retrieve unauthorized agent records. No character validation is performed on agent names, and downstream query errors are silently caught, masking injection failures with HTTP 200 responses.

Affected products

  • OpenBMB Internet of Agents up to commit 9d78e88e47160eb42ee1ee8538c05e1c2c47877a

Timeline

  • 2026-10-14: disclosed: Issue reported on GitHub
  • 2026-11-06: advisory: CVE-2026-123791 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.