{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aagentscope-aiagentscope/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:agentscope-ai:agentscope:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-123024"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AgentScope (\u003c= 2.0.11)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["agentscope-ai"],"content_html":"\u003cp\u003eA security vulnerability exists in the Agent Service component of AgentScope (versions up to 2.0.11). The issue resides in the 'get_current_user_id' function within 'src/agentscope/app/deps.py'. An attacker can bypass authentication mechanisms by manipulating the 'X-User-ID' HTTP header. Exploitation is possible remotely and public disclosure of the vulnerability has occurred. A fix via a pull request is currently pending acceptance.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthenticated access to the Agent Service. This effectively leads to missing authentication controls for the affected endpoint.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor web application logs for anomalous 'X-User-ID' header values or unauthorized access attempts to the Agent Service component.\u003c/li\u003e\n\u003cli\u003eInventory all instances of AgentScope within the environment and track the availability of a patch for version 2.0.11 or later.\u003c/li\u003e\n\u003cli\u003eUntil a formal patch is released, consider implementing strict ingress filtering or WAF rules to restrict access to the Agent Service endpoint.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T14:43:40Z","date_published":"2026-11-05T14:43:40Z","id":"https://feed.craftedsignal.io/briefs/2026-11-agentscope-auth-bypass/","summary":"AgentScope versions up to 2.0.11 contain an authentication bypass vulnerability in the Agent Service component, allowing remote attackers to manipulate the X-User-ID header to gain unauthorized access.","title":"AgentScope: Authentication bypass in Agent Service (CVE-2026-123024)","url":"https://feed.craftedsignal.io/briefs/2026-11-agentscope-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:agentscope-Ai:agentscope:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}