OpenBMB Internet of Agents: Improper neutralization in Agent Registry (CVE-2026-123791)
A vulnerability in the Agent Registry component of OpenBMB Internet of Agents allows remote attackers to manipulate data query logic via the key argument in the _primary_field_query function.
CVE search metadata
CVE search record: CVE-2026-123791. Severity: high. CVSS: 7.3. KEV: no. Product: Internet of Agents (up to commit 9d78e88e47160eb42ee1ee8538c05e1c2c47877a). Brief: OpenBMB Internet of Agents: Improper neutralization in Agent Registry (CVE-2026-123791). Brief link: https://feed.craftedsignal.io/briefs/2026-11-openbmb-internet-of-agents-injection/
Triage facts
Revision 1- Applicability
- Internet of Agents (up to commit 9d78e88e47160eb42ee1ee8538c05e1c2c47877a)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 7, 01:38 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A vulnerability exists in the Agent Registry component of OpenBMB Internet of Agents (up to commit 9d78e88e47160eb42ee1ee8538c05e1c2c47877a). The vulnerability resides in the _primary_field_query function of common/utils/milvus_utils.py. Manipulation of the key argument results in improper neutralization of special elements in data query logic. The attack may be launched remotely, and the exploit is public. The project has not yet responded to an issue report regarding this vulnerability.