CVE-2026-123032— OpenBMB Internet of Agents WebSocket Connection Manager app.py ConnectionManager.connect missing authentication

Quick assessment

Affected

OpenBMB Internet of Agents

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 OpenBMB Internet of Agents 项目（截至提交哈希 9d78e88e47160eb42ee1ee8538c05e1c2c47877a）中发现了一个安全漏洞。该漏洞影响组件"WebSocket 连接管理器”中文件的函数。攻击者可通过操纵参数绕过身份验证机制。该漏洞可被远程利用，且相关利用代码已公开，可能被用于实际攻击。该产品采用滚动发布策略以实现持续交付，因此无法提供受影响版本与修复版本的具体版本信息。项目方已较早通过问题报告获知此问题，但截至目前尚未作出回应。

CVSS 7.3 · High Updated Nov 06, 2026

Possible ATT&CK Techniques 2 AI

T1078 · Valid Accounts T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

OpenBMB Internet of Agents WebSocket Connection Manager app.py ConnectionManager.connect missing authentication

Source: CVE Program / CVE List V5

Vulnerability Description

A security flaw has been discovered in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function ConnectionManager.connect of the file im_server/app.py of the component WebSocket Connection Manager. The manipulation of the argument agent_name results in missing authentication. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

关键功能的认证机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
OpenBMB	Internet of Agents	9d78e88e47160eb42ee1ee8538c05e1c2c47877a	`cpe:2.3:a:openbmb:internet_of_agents::::::::`

II. Public POCs for CVE-2026-123032

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123032

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-123032 (1)

CVE-2026-123032 | OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a WebSocket Connection Manager im_server/app.py ConnectionManager.connect agent_name missing authentication (Issue 17) vdb-entry technical-description

Other References for CVE-2026-123032 (4)

https://github.com/OpenBMB/IoA/issues/17 exploit issue-tracking
https://vuldb.com/cve/CVE-2026-123032 third-party-advisory
https://vuldb.com/vuln/431401/cti signature permissions-required
https://vuldb.com/submit/1033550 third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-123032

IV. Related Vulnerabilities

Same vendor: OpenBMB

Same weakness: CWE-306