CVE-2026-123881 Details
Description
A vulnerability was found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This issue affects the function fetch_chat_record of the file im_server/app.py of the component Message Handler. The manipulation of the argument comm_id results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability exists in OpenBMB Internet of Agents versions prior to commit 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. The issue is located in the Message Handler component, specifically within the fetch_chat_record function of im_server/app.py. The vulnerability arises from inadequate access control on the comm_id argument, allowing remote exploitation. Non-members can send unlimited messages to any session, causing a broadcast amplification effect and unauthorized access to chat records.
To address this vulnerability, implement checks to verify that the message sender is a member of the session and matches the connection identity. Introduce rate limits and message size restrictions per session and connection. Additionally, require authentication, a specific comm_id, and pagination for accessing chat records.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/OpenBMB/IoA/issues/20 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-123881 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1033651 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/432019 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/432019/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenBMB Internet of Agents | 9d78e88e47160eb42ee1ee8538c05e1c2c47877a |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 7, 2026 | New CVE Received | [email protected] |