Internet of Agents: five CVEs, no fix, no vendor reply

01What happened

VulDB published five CVEs for OpenBMB's Internet of Agents between November 5 and 7, 2026, covering the code executor, the agent registry, the WebSocket connection manager and the chat store. GitHub user Se4n957 filed six security reports on the project's issue tracker on October 14, 2026, and the project has not replied to any of them. VulDB credits its user Evo1ution for the submissions.

02How it works

Code injection is the sharpest of the five: execute_code in im_client/agents/tools/code_executor.py takes a filename and a language argument from the caller and passes them to a downstream component without neutralizing them. The other four are missing or misplaced checks. ConnectionManager.connect accepts any agent_name on the WebSocket endpoint without authenticating it, register takes a name and description with no authentication, fetch_chat_record returns the whole chat database when comm_id is absent, and agent names are concatenated into Milvus query expressions unsanitized.

03Who is affected

Anyone running OpenBMB's Internet of Agents is exposed, up to the commit listed below. The project publishes no releases and no version numbers, so there is no safe version to pin to. VulDB records a public exploit for each of the five flaws and rates them all remotely reachable with no privileges or user interaction.

04What to do

Treat an Internet of Agents deployment as unpatchable: take it off any reachable network, or remove it. If the framework must keep running, block its server endpoints at the network layer and do not let it hold credentials or data you care about.

Sources 6 links, all fetched

1. 1github.comCode Injection CVE
2. 2github.comWebSocket Auth CVE
3. 3github.comQuery Injection CVE
4. 4github.comChat Record CVE
5. 5cve.orgRegistry CVE Record
6. 6github.comReporter's Issues