CVE-2026-123964 Details
Description
A vulnerability was detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function launch_goal of the file im_client/communication/communication_layer.py of the component Collaboration Layer. Performing a manipulation of the argument max_turns results in infinite loop. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
A denial-of-service vulnerability has been identified in OpenBMB Internet of Agents versions prior to commit 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. The issue arises in the Collaboration Layer component, specifically within the launch_goal function of the communication_layer.py file. The vulnerability is triggered by manipulating the max_turns argument, which can lead to an infinite loop. This issue can be exploited remotely, causing teams to hang indefinitely while consuming resources.
It is recommended to implement a hard server-side cap on turns, automatically concluding discussions when the limit is reached. Adding a timeout and fallback for the conclusion polling loop, validating the max_turns parameter, and introducing a mechanism to conclude tasks that exceed their allotted time would also address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/OpenBMB/IoA/issues/22 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-123964 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1033798 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/432034 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/432034/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-404 | Improper Resource Shutdown or Release | [email protected] |
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenBMB Internet of Agents | 9d78e88e47160eb42ee1ee8538c05e1c2c47877a |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 7, 2026 | New CVE Received | [email protected] |