CVE-2026-123024
agentscope-ai AgentScope Agent Service deps.py get_current_user_id missing authentication
CVSS Score
7.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability has been found in agentscope-ai AgentScope up to 2.0.11. This impacts the function get_current_user_id of the file src/agentscope/app/deps.py of the component Agent Service. Such manipulation of the argument X-User-ID leads to missing authentication. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
| CWE | CWE-306 CWE-287 |
| Vendor | agentscope-ai |
| Product | agentscope |
| Published | Nov 5, 2026 |
| Last Updated | Nov 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for agentscope-ai agentscope
Be the first to know when new high vulnerabilities affecting agentscope-ai agentscope are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
agentscope-ai / AgentScope
2.0.0 2.0.1 2.0.2 2.0.3 2.0.4 2.0.5 2.0.6 2.0.7 2.0.8 2.0.9 2.0.10 2.0.11
References
vuldb.com: https://vuldb.com/vuln/431397 vuldb.com: https://vuldb.com/vuln/431397/cti vuldb.com: https://vuldb.com/cve/CVE-2026-123024 vuldb.com: https://vuldb.com/submit/1033132 github.com: https://github.com/agentscope-ai/agentscope/issues/3314 github.com: https://github.com/agentscope-ai/agentscope/pull/3448 github.com: https://github.com/ybyu-ieu/agent-security-advisories/blob/main/agentscope/agentscope-agent-service-x-user-id-missing-authentication.md github.com: https://github.com/agentscope-ai/agentscope/
Credits
🔍 Ybyu (VulDB User) VulDB CNA Team