# Internet of Agents: five CVEs, no fix, no vendor reply

> Internet of Agents has five published CVEs, no patched version, and no code change since October 2025.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** VulDB
- **Disclosed:** 2026-11-06
- **CVE:** CVE-2026-123675
- **CVSS:** 5.5
- **Affects:** Internet of Agents
- **Research by:** [Se4n957](https://github.com/Se4n957)
- **Primary source:** https://github.com/advisories/GHSA-w43h-qvhf-jh65
- **Page:** https://theinjection.dev/items/openbmb-ioa-november-cves/

Five CVEs published November 5 to 7, 2026 cover code injection, missing authentication and query injection in OpenBMB's Internet of Agents. No patched version exists and the project has not answered the reports.

## What happened

VulDB published five CVEs for OpenBMB's Internet of Agents between November 5 and 7, 2026, covering the code executor, the agent registry, the WebSocket connection manager and the chat store. GitHub user Se4n957 filed six security reports on the project's issue tracker on October 14, 2026, and the project has not replied to any of them. VulDB credits its user Evo1ution for the submissions.

## How it works

Code injection is the sharpest of the five: execute_code in im_client/agents/tools/code_executor.py takes a filename and a language argument from the caller and passes them to a downstream component without neutralizing them. The other four are missing or misplaced checks. ConnectionManager.connect accepts any agent_name on the WebSocket endpoint without authenticating it, register takes a name and description with no authentication, fetch_chat_record returns the whole chat database when comm_id is absent, and agent names are concatenated into Milvus query expressions unsanitized.

## Who is affected

Anyone running OpenBMB's Internet of Agents is exposed, up to the commit listed below. The project publishes no releases and no version numbers, so there is no safe version to pin to. VulDB records a public exploit for each of the five flaws and rates them all remotely reachable with no privileges or user interaction.

## What to do

Treat an Internet of Agents deployment as unpatchable: take it off any reachable network, or remove it. If the framework must keep running, block its server endpoints at the network layer and do not let it hold credentials or data you care about.

## Quick facts

- **Affected:** OpenBMB Internet of Agents up to commit 9d78e88e47160eb42ee1ee8538c05e1c2c47877a, which has no tagged releases
- **CVEs:** CVE-2026-123032, CVE-2026-123675, CVE-2026-123791, CVE-2026-123881 and CVE-2026-123963
- **Fixed in:** No patched version; the project has not responded to the reports
- **CVSS:** 5.5 CVSS v4.0 for four of the five and 6.9 for CVE-2026-123963, all from VulDB
- **Found by:** Se4n957, in issues 17 to 22 on the project's tracker
- **Last code change:** October 4, 2025
- **Status:** Unpatched, with a public exploit recorded for each CVE

## Sources

1. [Code Injection CVE](https://github.com/advisories/GHSA-w43h-qvhf-jh65)
2. [WebSocket Auth CVE](https://github.com/advisories/GHSA-2w86-3j6h-v867)
3. [Query Injection CVE](https://github.com/advisories/GHSA-v6cp-c9hv-m87w)
4. [Chat Record CVE](https://github.com/advisories/GHSA-7gvr-jhhp-xg9c)
5. [Registry CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-123963)
6. [Reporter's Issues](https://github.com/OpenBMB/IoA/issues/18)