{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/internet-of-agents--9d78e88e47160eb42ee1ee8538c05e1c2c47877a/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:openbmb:internet_of_agents:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-123032"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Internet of Agents (\u003c= 9d78e88e47160eb42ee1ee8538c05e1c2c47877a)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["OpenBMB"],"content_html":"\u003cp\u003eCVE-2026-123032 describes an authentication bypass vulnerability within the ConnectionManager.connect function of the im_server/app.py file in the OpenBMB Internet of Agents WebSocket Connection Manager. An unauthenticated attacker can remotely manipulate the agent_name argument to circumvent authentication mechanisms. Public exploit code is available for this vulnerability. As the project uses a rolling release model, no specific version numbers are provided; all instances up to commit hash 9d78e88e47160eb42ee1ee8538c05e1c2c47877a are considered affected.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows unauthenticated remote attackers to establish connections to the server without proper authentication, potentially leading to unauthorized access to agent infrastructure or control functionality.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor websocket connection logs for anomalous agent_name values or unexpected connection patterns from external, unauthenticated sources.\u003c/li\u003e\n\u003cli\u003eAudit the project repository for updates or patches, as the maintainers have not yet responded to the reported vulnerability.\u003c/li\u003e\n\u003cli\u003eImplement network-level restrictions or authentication proxies in front of the Internet of Agents server to limit exposure until a permanent patch is integrated into the rolling release.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T15:47:00Z","date_published":"2026-11-05T15:47:00Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openbmb-internet-of-agents-auth-bypass/","summary":"An authentication bypass vulnerability in the OpenBMB Internet of Agents WebSocket Connection Manager allows unauthenticated remote attackers to gain unauthorized access via manipulation of the agent_name parameter.","title":"OpenBMB Internet of Agents: Authentication Bypass (CVE-2026-123032)","url":"https://feed.craftedsignal.io/briefs/2026-11-openbmb-internet-of-agents-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Internet of Agents (\u003c= 9d78e88e47160eb42ee1ee8538c05e1c2c47877a)","version":"https://jsonfeed.org/version/1.1"}