# AgentScope: three CVEs land, and the MCP workspace flaw is unpatched

> AgentScope's agent service accepts an MCP configuration from any caller and spawns the command it names, with no release to upgrade to.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** GitHub Advisory Database
- **Disclosed:** 2026-11-05
- **CVE:** CVE-2026-123022
- **CVSS:** 5.5
- **Affects:** AgentScope, agentscope (PyPI)
- **Research by:** [Yongbo Yu](https://github.com/ybyu-ieu/agent-security-advisories)
- **Primary source:** https://github.com/advisories/GHSA-m997-8g56-6phf
- **Page:** https://theinjection.dev/items/agentscope-agent-service-november-cves/

AgentScope received three CVEs on November 5, 2026 for flaws Yongbo Yu reported in October, including unauthenticated command execution through the agent service's MCP workspace endpoint, which still has no fix.

## What happened

Three CVEs for AgentScope were published on November 5, 2026: CVE-2026-123022 for command injection through the MCP workspace endpoint, CVE-2026-123024 for the agent service's missing authentication, and CVE-2026-123023 for an authorization error in the bash tool. Independent researcher Yongbo Yu reported them in public issues 3312, 3313 and 3314; the MCP workspace issue was filed on October 14, 2026, after a private report on July 8, 2026 drew no maintainer response.

## How it works

The POST /workspace/mcp endpoint accepts a stdio MCP configuration whose command field is a free-form string with no allowlist, passes it into stdio_client() and spawns the process when the configuration is saved. Spawning happens before the MCP handshake, so the command runs even when the request returns an error or times out. Authentication on the service is an X-User-ID header that only has to be non-empty, which is the separate CVE-2026-123024, and the bash tool flaw sits in check_permissions in _bash.py, where manipulation causes incorrect authorization.

## Who is affected

AgentScope versions up to 2.0.11 whose agent service API is reachable over a network are exposed to the first two flaws; Yu verified the MCP workspace flaw on 2.0.4 with the API bound to 0.0.0.0:8000 and the default local workspace. Docker and E2B backends keep the spawned process inside the sandbox, where it still executes. The bash tool flaw covers versions up to 2.0.8.

## What to do

Upgrade to AgentScope 2.0.9 or later to pick up the bash tool fix. For the other two, the advisory's operator workarounds are to bind the service to 127.0.0.1 instead of 0.0.0.0, or to block POST /workspace/mcp at the network or proxy layer, until a fix ships.

## Quick facts

- **Affected:** AgentScope up to 2.0.11 for CVE-2026-123022 and CVE-2026-123024, up to 2.0.8 for CVE-2026-123023
- **Fixed in:** 2.0.9 for the bash tool flaw; no fixed release for the other two
- **CVE:** CVE-2026-123022, CVE-2026-123023 and CVE-2026-123024, all published November 5, 2026
- **CVSS:** 5.5 under CVSS 4.0 for each advisory; Yu's own advisory scores the MCP workspace flaw 9.8 under CVSS 3.1
- **Found by:** Yongbo Yu, independent researcher
- **Status:** Exploit details public; pull request 3448, a partial opt-in allowlist, awaits maintainer review
- **Attack type:** Unauthenticated process execution through an MCP configuration endpoint

## Questions

### Which AgentScope release fixes the November 2026 CVEs?

AgentScope 2.0.9 fixes CVE-2026-123023, the bash tool authorization error, in commit 6b43b13. No release fixes CVE-2026-123022 or CVE-2026-123024: both advisories list affected versions up to 2.0.11 and say the fix pull request awaits acceptance. Operators have to mitigate at the network layer until maintainers ship a release.

### Is an AgentScope instance on localhost affected by CVE-2026-123022?

Yongbo Yu's advisory treats network reachability as the condition, and the proof of concept ran against the agent service bound to 0.0.0.0:8000. Binding to 127.0.0.1, or blocking POST /workspace/mcp at a proxy, are the operator workarounds the advisory lists. Container backends such as Docker and E2B confine the spawned process without preventing it from running.

### Why do the advisories and the researcher disagree on AgentScope's severity?

The published advisories score each AgentScope flaw 5.5 under CVSS 4.0, with low impact on confidentiality, integrity and availability, while Yu's own advisory scores the MCP workspace flaw 9.8 under CVSS 3.1 with high impact on all three. The numbers come from different CVSS versions and different impact judgements, so compare the vectors rather than the scores.

## Sources

1. [MCP Workspace CVE](https://github.com/advisories/GHSA-m997-8g56-6phf)
2. [Missing Auth CVE](https://github.com/advisories/GHSA-62xg-m469-57vg)
3. [Bash Tool CVE](https://github.com/advisories/GHSA-fh34-mp6h-q3xc)
4. [Researcher Advisory](https://github.com/ybyu-ieu/agent-security-advisories/blob/main/agentscope/agentscope-mcp-stdio-workspace-unauthenticated-process-execution.md)
5. [AgentScope Issue 3312](https://github.com/agentscope-ai/agentscope/issues/3312)
6. [Mitigation Pull Request](https://github.com/agentscope-ai/agentscope/pull/3448)