CVE-2026-123963: OpenBMB Internet of Agents auth bypass in registration endpoint

CVE-2026-123963 · Severity: high · CVSS 7.3 · Published 2026-11-07

OpenBMB Internet of Agents is a platform for deploying AI assistant agents in a shared registry. The /register endpoint lacks authentication, rate limiting, and input validation, allowing attackers to register malicious agents that poison the retrieval system and exhaust computational resources. Exploitation enables data integrity attacks, service disruption, and potential further compromise through compromised agents.

Technologies: OpenBMB Internet of Agents. Vendors: OpenBMB.

Quick answers

Is CVE-2026-123963 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-123963 being exploited in the wild.
How severe is CVE-2026-123963?
High severity, with a CVSS score of 7.3, published 7 November 2026.
Which products and versions are affected?
OpenBMB Internet of Agents up to commit 9d78e88e47160eb42ee1ee8538c05e1c2c47877a.
Is there a fix for CVE-2026-123963?
No fixed version is recorded yet. Implement authentication on the /register endpoint, enforce rate limiting and per-user quotas, and validate name and desc at the API layer before vectorization—enforcing non-empty values, character allowlists, and length caps matching the schema. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-123963 attacked?
It is attacked over the network.
Am I affected by CVE-2026-123963?
Check whether you run OpenBMB Internet of Agents at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Implement authentication on the /register endpoint, enforce rate limiting and per-user quotas, and validate name and desc at the API layer before vectorization—enforcing non-empty values, character allowlists, and length caps matching the schema.

Technical details

The /register endpoint in im_server/app.py accepts AgentInfo objects with name and desc fields without authentication, rate limiting, length validation, or content validation, despite schema constraints defined in agent_registry.yaml. The vulnerable code vectorizes input via embedding before downstream Milvus validation, so oversized requests consume compute even when later rejected. An attacker can register unlimited agents with keyword-stuffed descriptions to poison /retrieve_assistant results and trigger registration floods.

Affected products

  • OpenBMB Internet of Agents up to commit 9d78e88e47160eb42ee1ee8538c05e1c2c47877a

Timeline

  • 2026-10-14: disclosed: Security issue #21 opened on GitHub
  • 2026-11-07: advisory: CVE-2026-123963 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.