CVE-2026-123023
Deferred Deferred - Pending Action

Incorrect Authorization in AgentScope AI Tool via Bash Component

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: VulDB

Description
A flaw has been found in agentscope-ai AgentScope up to 2.0.8. This affects the function check_permissions of the file src/agentscope/tool/_builtin/_bash.py of the component Bash Tool. This manipulation causes incorrect authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used. Upgrading to version 2.0.9 mitigates this issue. Patch name: 6b43b13a46401e86abd3defeed9a8bfe5b37bc6d. It is recommended to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-123023
EUVD
EUVD-2026-117442

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-123023 is a vulnerability in AgentScope versions up to 2.0.8 where the Bash tool incorrectly treats the 'tee' command as read-only. This allows attackers to bypass permission checks and write arbitrary files without user confirmation via the REST API or prompt injection. The flaw exists because 'tee' was included in the SAFE_COMMANDS set despite its file-writing capability.

Detection Guidance

To detect this vulnerability, check if AgentScope versions 2.0.4 or earlier are installed. Inspect the Bash tool's SAFE_COMMANDS set in _bash_parser.py for the presence of 'tee'. Verify if the check_permissions() function in _bash.py incorrectly allows 'tee' without proper security checks. Monitor for unauthorized file writes via REST API or prompt injection attempts targeting sensitive files like authorized_keys or .env.

Impact Analysis

This vulnerability allows attackers to write malicious content to sensitive files like authorized_keys, .bashrc, or .env without triggering confirmation prompts. Depending on the deployment, it could lead to arbitrary file writes or even remote code execution. All default deployments are vulnerable since the Bash tool is enabled by default and cannot be disabled.

Compliance Impact

This vulnerability could lead to unauthorized file writes, potentially exposing sensitive data. For GDPR, this may result in unauthorized access to personal data, violating Article 32 (security of processing). For HIPAA, it could allow unauthorized modifications to protected health information, violating the Security Rule. The lack of proper authorization checks undermines data integrity and confidentiality requirements in both standards.

Mitigation Strategies
  • Upgrade AgentScope to version 2.0.9 or later to address the vulnerability in the Bash tool.
  • Review and restrict access to the AgentScope REST API endpoints to prevent unauthorized command execution.
  • Monitor file system changes, especially in sensitive directories like home folders or configuration files.
  • Disable or tightly control the Bash tool if not required for operations to reduce attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123023. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...