AgentScope: Incorrect authorization in Bash Tool (CVE-2026-123023)
AgentScope versions 2.0.8 and earlier contain an authorization flaw in the Bash Tool component that allows remote attackers to bypass permission checks and execute unauthorized commands.
CVE search metadata
CVE search record: CVE-2026-123023. Severity: high. CVSS: 7.3. KEV: no. Product: AgentScope (<= 2.0.8). Brief: AgentScope: Incorrect authorization in Bash Tool (CVE-2026-123023). Brief link: https://feed.craftedsignal.io/briefs/2026-11-agentscope-auth-bypass-4f8d4050/
Triage facts
Revision 1- Applicability
- AgentScope (<= 2.0.8)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 5, 16:20 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
A vulnerability exists in the check_permissions function within src/agentscope/tool/_builtin/_bash.py of the AgentScope Bash Tool. The vulnerability is caused by incorrect authorization logic, which can be exploited remotely to perform unauthorized actions. A public exploit is available. This issue is resolved in version 2.0.9.
Impact
Successful exploitation allows a remote attacker to bypass intended authorization constraints, resulting in unauthorized command execution via the affected Bash tool component.
Recommendation
- Upgrade AgentScope to version 2.0.9 or later immediately.
- Audit logs for instances of the AgentScope Bash Tool execution to identify unauthorized access attempts.
- If upgrading is not immediately possible, restrict network access to environments hosting AgentScope instances.
Immediate actions
Patch AgentScope to version 2.0.9
Threat Hunt
Identify systems running AgentScope versions <= 2.0.8
Data: Software inventory logs, Package manager manifests
Mitigations
Upgrade AgentScope to 2.0.9
CVE-2026-123023