CVE-2026-123032

    Dashboard / Vulnerabilities / CVE-2026-123032

    CVE-2026-123032

    Published: 5 Nov 2026Last Modified: 7 Nov 2026

    Summary: OpenBMB Internet of Agents WebSocket Connection Manager app.py ConnectionManager.connect missing authentication

    Details: A security flaw has been discovered in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function ConnectionManager.connect of the file im_server/app.py of the component WebSocket Connection Manager. The manipulation of the argument agent_name results in missing authentication. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123032.json, https://nvd.nist.gov/vuln/detail/CVE-2026-123032, https://vuldb.com/cve/CVE-2026-123032, https://vuldb.com/submit/1033550, https://vuldb.com/vuln/431401, https://github.com/OpenBMB/IoA/issues/17, https://vuldb.com/vuln/431401/cti

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 9d78e88e47160eb42ee1ee8538c05e1c2c47877a
    Fixed -None

    Affected versions

    9d78e88e47160eb42ee1ee8538c05e1c2c47877a

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-123032 | CVE-DB