Agentscope-Ai - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/agentscope-ai/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 14:43:40 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAgentScope: Authentication bypass in Agent Service (CVE-2026-123024)https://feed.craftedsignal.io/briefs/2026-11-agentscope-auth-bypass/Thu, 05 Nov 2026 14:43:40 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-agentscope-auth-bypass/AgentScope versions up to 2.0.11 contain an authentication bypass vulnerability in the Agent Service component, allowing remote attackers to manipulate the X-User-ID header to gain unauthorized access.A security vulnerability exists in the Agent Service component of AgentScope (versions up to 2.0.11). The issue resides in the 'get_current_user_id' function within 'src/agentscope/app/deps.py'. An attacker can bypass authentication mechanisms by manipulating the 'X-User-ID' HTTP header. Exploitation is possible remotely and public disclosure of the vulnerability has occurred. A fix via a pull request is currently pending acceptance.

Impact

Successful exploitation allows for unauthenticated access to the Agent Service. This effectively leads to missing authentication controls for the affected endpoint.

Recommendation

  • Monitor web application logs for anomalous 'X-User-ID' header values or unauthorized access attempts to the Agent Service component.
  • Inventory all instances of AgentScope within the environment and track the availability of a patch for version 2.0.11 or later.
  • Until a formal patch is released, consider implementing strict ingress filtering or WAF rules to restrict access to the Agent Service endpoint.
]]>highadvisory