AgentScope: three CVEs land, and the MCP workspace flaw is unpatched

01What happened

Three CVEs for AgentScope were published on November 5, 2026: CVE-2026-123022 for command injection through the MCP workspace endpoint, CVE-2026-123024 for the agent service's missing authentication, and CVE-2026-123023 for an authorization error in the bash tool. Independent researcher Yongbo Yu reported them in public issues 3312, 3313 and 3314; the MCP workspace issue was filed on October 14, 2026, after a private report on July 8, 2026 drew no maintainer response.

02How it works

The POST /workspace/mcp endpoint accepts a stdio MCP configuration whose command field is a free-form string with no allowlist, passes it into stdio_client() and spawns the process when the configuration is saved. Spawning happens before the MCP handshake, so the command runs even when the request returns an error or times out. Authentication on the service is an X-User-ID header that only has to be non-empty, which is the separate CVE-2026-123024, and the bash tool flaw sits in check_permissions in _bash.py, where manipulation causes incorrect authorization.

03Who is affected

AgentScope versions up to 2.0.11 whose agent service API is reachable over a network are exposed to the first two flaws; Yu verified the MCP workspace flaw on 2.0.4 with the API bound to 0.0.0.0:8000 and the default local workspace. Docker and E2B backends keep the spawned process inside the sandbox, where it still executes. The bash tool flaw covers versions up to 2.0.8.

04What to do

Upgrade to AgentScope 2.0.9 or later to pick up the bash tool fix. For the other two, the advisory's operator workarounds are to bind the service to 127.0.0.1 instead of 0.0.0.0, or to block POST /workspace/mcp at the network or proxy layer, until a fix ships.

Questions people ask

Which AgentScope release fixes the November 2026 CVEs?

AgentScope 2.0.9 fixes CVE-2026-123023, the bash tool authorization error, in commit 6b43b13. No release fixes CVE-2026-123022 or CVE-2026-123024: both advisories list affected versions up to 2.0.11 and say the fix pull request awaits acceptance. Operators have to mitigate at the network layer until maintainers ship a release.

Is an AgentScope instance on localhost affected by CVE-2026-123022?

Yongbo Yu's advisory treats network reachability as the condition, and the proof of concept ran against the agent service bound to 0.0.0.0:8000. Binding to 127.0.0.1, or blocking POST /workspace/mcp at a proxy, are the operator workarounds the advisory lists. Container backends such as Docker and E2B confine the spawned process without preventing it from running.

Why do the advisories and the researcher disagree on AgentScope's severity?

The published advisories score each AgentScope flaw 5.5 under CVSS 4.0, with low impact on confidentiality, integrity and availability, while Yu's own advisory scores the MCP workspace flaw 9.8 under CVSS 3.1 with high impact on all three. The numbers come from different CVSS versions and different impact judgements, so compare the vectors rather than the scores.

Sources 6 links, all fetched

1. 1github.comMCP Workspace CVE
2. 2github.comMissing Auth CVE
3. 3github.comBash Tool CVE
4. 4github.comResearcher Advisory
5. 5github.comAgentScope Issue 3312
6. 6github.comMitigation Pull Request