CVE-2026-123024: agentscope-ai AgentScope Agent Service deps.py get_current_user_id missing authentication
A vulnerability has been found in agentscope-ai AgentScope up to 2.0.11. This impacts the function getcurrentuserid of the file src/agentscope/app/deps.py of the component Agent Service. Such manipulation of the argument X-User-ID leads to missing authentication. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
Event History
Frequently Asked Questions
Which deployments are exposed?
AgentScope Agent Service deployments using versions up to 2.0.11 are affected where the get_current_user_id function in src/agentscope/app/deps.py handles the X-User-ID argument.
What does an attacker need to exploit this issue?
The attack can be performed remotely and requires manipulation of the X-User-ID argument. The supplied data indicates no authentication or user interaction is required.
Is public exploit information available?
Yes. Public exploit disclosure is indicated, and the exploit may be used.
Is a fix available?
A pull request intended to fix the issue exists, but it was awaiting acceptance at the time of the reported information.