OpenBMB Internet of Agents: Authentication Bypass (CVE-2026-123032)

CVE-2026-123032 describes an authentication bypass vulnerability within the ConnectionManager.connect function of the im_server/app.py file in the OpenBMB Internet of Agents WebSocket Connection Manager. An unauthenticated attacker can remotely manipulate the agent_name argument to circumvent authentication mechanisms. Public exploit code is available for this vulnerability. As the project uses a rolling release model, no specific version numbers are provided; all instances up to commit hash 9d78e88e47160eb42ee1ee8538c05e1c2c47877a are considered affected.

Impact

The vulnerability allows unauthenticated remote attackers to establish connections to the server without proper authentication, potentially leading to unauthorized access to agent infrastructure or control functionality.

Recommendation

• Monitor websocket connection logs for anomalous agent_name values or unexpected connection patterns from external, unauthenticated sources.
• Audit the project repository for updates or patches, as the maintainers have not yet responded to the reported vulnerability.
• Implement network-level restrictions or authentication proxies in front of the Internet of Agents server to limit exposure until a permanent patch is integrated into the rolling release.