AgentScope Flaws Expose MCP Workspace to Unauthenticated Command Injection (CVE-2026-123022, CVE-2026-123024)

Key Takeaways

• CVE-2026-123022 and CVE-2026-123024 were published on November 5, 2026, for AgentScope up to 2.0.11.
• The MCP Workspace API passes a command value straight into a system process call.
• A separate flaw trusts a user ID header without checking authentication.
• Public proofs of concept exist, a fix is pending, and no attacks have been reported.

An Agent Framework That Runs Whatever It Is Told

AgentScope, an open-source framework for building AI agents, has flaws that let remote attackers run system commands. VulDB lists a public proof of concept for the MCP command injection, raising the stakes for exposed deployments.

What We Know

Both CVEs were published on November 5, 2026, and affect AgentScope versions up to 2.0.11. A fix is in a pending pull request.

CVE-2026-123022 sits in the MCP Workspace API. According to OffSeq, CVE-2026-123024 is a missing authentication flaw with a public exploit.

A related flaw, CVE-2026-123023, affects AgentScope's Bash tool permission checks and is fixed in 2.0.9. No attacks have been reported.

What Could Happen

AgentScope lets agents launch MCP servers. In affected versions, the MCP Workspace API passed an attacker-supplied command value straight into a system process call.

Separately, the agent service accepted a user ID from a request header without verifying who sent it, so attackers could act as any user.

Together, these flaws could let a remote attacker reach the workspace API and run operating system commands on the host. From there, they could access the keys and data the agents use.

Why It Matters

Agent framework hosts often hold model API keys and credentials for the tools agents call. A compromise exposes every workflow built on that host.

Public exploits shorten the time before attacks begin, and a fix is still pending.

The case repeats a pattern seen across AI frameworks: MCP launch settings treated as trusted input. Teams should restrict access to these APIs and track framework versions.

PointGuard AI Perspective

AgentScope is another reminder that MCP server definitions are executable code. PointGuard AI helps teams find and govern them.

The MCP Security Gateway centralizes MCP connections and enforces which servers and tools each agent may use. An attacker cannot quietly register a process that runs arbitrary commands.

AI Security Posture Management discovers self-hosted AI platforms, flags vulnerable versions and risky settings, and highlights instances exposed to untrusted networks.

PointGuard AI supply chain security tracks the open-source frameworks and MCP servers in use, scoring them on known vulnerabilities so risky versions can be blocked.

Secure agent development starts with knowing where these frameworks run and what they can reach.

Incident Scorecard Details

Total AISSI Score: 5.10/10

Criticality: 6, Framework hosts hold model keys and tool credentials. AISSI weighting: 25%

Propagation: 6, Compromise reaches every agent workflow on the host. AISSI weighting: 20%

Exploitability: 5, Public proofs of concept, no observed attacks. AISSI weighting: 15%

Supply Chain: 6, Risk sits in a self-hosted open-source agent framework. AISSI weighting: 15%

Business Impact: 3, Niche deployment base with no reported harm. AISSI weighting: 25%

Sources

Third-Party Sources

• VulDB: CVE-2026-123022 AgentScope MCP Workspace API Command Injection
• OffSeq: CVE-2026-123024 AgentScope Missing Authentication

PointGuard AI Sources

• PointGuard AI MCP Security Gateway
• PointGuard AI Security Posture Management
• PointGuard AI Supply Chain Security