{"id":7210,"date":"2026-11-11T16:18:12","date_gmt":"2026-11-11T16:18:12","guid":{"rendered":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce"},"modified":"2026-11-11T16:18:12","modified_gmt":"2026-11-11T16:18:12","slug":"cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce","status":"publish","type":"post","link":"https:\/\/i10x.ai\/news\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce","title":{"rendered":"CVE-2026-123022: AgentScope MCP Workspace Allows Unauthenticated Remote Code Execution"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Critical Command Injection in AgentScope MCP Workspace<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A high-severity vulnerability tracked as **CVE-2026-123022** has been disclosed in agentscope-ai AgentScope, affecting versions up to 2.0.11. The flaw permits unauthenticated remote attackers to execute arbitrary operating system commands on servers running the AgentScope agent framework.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Vulnerability Details<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The vulnerability resides in the MCP (Model Context Protocol) workspace API endpoint, specifically in the file `src\/agentscope\/mcp\/_config.py` within the `subprocess.Popen` function call. According to the public advisory, the `StdioMCPConfig.command` field is declared as a string with no validators and no allowlist or trusted-directory restriction.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The `POST \/workspace\/mcp` endpoint accepts caller-supplied stdio MCP configurations whose `command` field names an arbitrary local executable. When the configuration is saved, the server spawns that process. The vulnerability is classified as CWE-78 (OS Command Injection).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Attack Vector<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The endpoint enforces no server-side authentication or authorization. The caller-supplied `X-User-ID` header\u2014described in the source code as &#8220;Temporary header-based identity&#8221;\u2014is accepted as identity context and can be trivially spoofed. An attacker who can reach the AgentScope API (which defaults to binding on 0.0.0.0:8000 in LocalWorkspace mode) can register a stdio MCP entry that executes an arbitrary local executable with attacker-controlled arguments.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For stateful MCPs, the `add_mcp()` function calls `mcp_client.connect()` immediately on save, so the configured process starts before MCP protocol negotiation completes.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Impact and Severity<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The National Vulnerability Database assigned this vulnerability a CVSS score of **7.3 (High)**. The public advisory from the security researcher who discovered the flaw assessed it as CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H, which would yield a score of 9.8 (Critical) if the PR:N (no privileges required) metric is confirmed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Successful exploitation grants the attacker remote code execution as the OS user running the AgentScope server, enabling:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Disclosure of local files and environment variables, including LLM API keys<\/li><li>Modification or deletion of application data<\/li><li>Installation of further payloads<\/li><li>Denial of service<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">No credentials, user interaction, or special preconditions are required beyond network reachability.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Proof of Concept<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The vulnerability was dynamically verified on 2026-07-08 against agentscope version 2.0.4 on Windows 11. The researcher registered a command `&#8221;cmd&#8221;` with arguments `[&#8220;\/c&#8221;,echo POC_MARKER > poc_marker.txt]`, which successfully created the marker file containing `POC_MARKER`. The subsequent HTTP 500 error or timeout is the expected MCP handshake failure\u2014`subprocess.Popen` had already spawned the attacker&#8217;s process by that point.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Affected Versions and Status<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The vulnerability affects AgentScope versions up to and including **2.0.11**. According to the NVD listing, a pull request to fix this issue has been submitted but awaits acceptance. Pull request #3448 on the AgentScope GitHub repository proposes adding an opt-in allowlist for stdio MCP commands through a new `allowed_stdio_commands` parameter in `create_app()`.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When set, a stdio MCP whose command is not listed would be rejected with HTTP 403 before the workspace starts it. The proposed fix includes:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>`None` (default): unchanged behavior, no breaking change<\/li><li>`[&#8220;npx&#8221;, &#8220;uvx&#8221;]`: only listed commands accepted<\/li><li>`[]`: stdio MCPs refused entirely on the endpoint<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Matching is exact (no basename\/path normalization). HTTP MCPs are not affected by the allowlist.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Disclosure Timeline<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The issue was initially reported privately via GitHub Private Vulnerability Reporting on **2026-07-08** (advisory GHSA-h4fc-fmm3-h8hg). As of 2026-08-30, the advisory remained in Triage status with no maintainer response, prompting the researcher to file a public bug report as issue #3312 on **2026-10-14**. The pull request #3448 was opened on **2026-10-23**.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Workarounds<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Until a patch is released and applied, administrators can mitigate the risk by:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Binding the AgentScope service to `127.0.0.1` instead of `0.0.0.0`<\/li><li>Blocking `POST \/workspace\/mcp` at the network or reverse-proxy layer<\/li><li>Using Docker or E2B workspace backends, which contain the spawned process in a sandbox (though the command still executes within the sandbox)<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Recommendations<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Organizations running AgentScope in production should immediately implement the workarounds listed above if the service is exposed to untrusted networks. Monitor the official AgentScope repository for the acceptance and release of pull request #3448 or an alternative fix, and apply updates as soon as they become available.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The researcher&#8217;s full advisory notes that this vulnerability is separate from another authentication issue (issue #3314) concerning X-User-ID header spoofing, which is addressed by a different pull request (#3329).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-123022\" target=\"_blank\" rel=\"noreferrer noopener\">NVD &#8211; CVE-2026-123022<\/a><\/li><li><a href=\"https:\/\/github.com\/agentscope-ai\/agentscope\/issues\/3312\" target=\"_blank\" rel=\"noreferrer noopener\">GitHub Issue #3312 &#8211; AgentScope unauthenticated arbitrary process execution<\/a><\/li><li><a href=\"https:\/\/github.com\/agentscope-ai\/agentscope\/pull\/3448\" target=\"_blank\" rel=\"noreferrer noopener\">GitHub Pull Request #3448 &#8211; Add opt-in allowlist for stdio MCP commands<\/a><\/li><li><a href=\"https:\/\/github.com\/ybyu-ieu\/agent-security-advisories\/blob\/main\/agentscope\/agentscope-mcp-stdio-workspace-unauthenticated-process-execution.md\" target=\"_blank\" rel=\"noreferrer noopener\">Full Security Advisory &#8211; AgentScope MCP stdio workspace unauthenticated process execution<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>A critical command injection vulnerability in AgentScope up to version 2.0.11 permits unauthenticated remote attackers to execute arbitrary processes through the MCP workspace API.<\/p>\n","protected":false},"author":2,"featured_media":7209,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"paper_title":"","paper_url":"","pdf_url":"","doi":"","arxiv_id":"","authors":"","institutions":"","paper_date":"","venue":"","peer_reviewed":false,"code_url":"","data_url":"","funding_coi":"","figure_license":"","paper_license":"","replication":"","study_models":"","study_sample":"","footnotes":"","_yoast_wpseo_primary_category":"65","_nx_sec_severity":"high","_nx_sec_affected":"AgentScope versions up to 2.0.11","_nx_sec_status":"patch-available","_nx_sec_kicker":"CRITICAL: Unauthenticated RCE in AgentScope MCP API"},"categories":[14,65,12,28],"tags":[],"companies":[],"products":[],"class_list":["post-7210","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-agents","category-ai-security","category-policy-safety","category-security-defense"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>CVE-2026-123022 AgentScope RCE Vulnerability<\/title>\n<meta name=\"description\" content=\"CVE-2026-123022 allows unauthenticated attackers to execute arbitrary code on AgentScope servers via MCP workspace API command injection with CVSS 7.3.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CVE-2026-123022 AgentScope RCE Vulnerability\" \/>\n<meta property=\"og:description\" content=\"CVE-2026-123022 allows unauthenticated attackers to execute arbitrary code on AgentScope servers via MCP workspace API command injection with CVSS 7.3.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce\" \/>\n<meta property=\"og:site_name\" content=\"i10X News\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-11T16:18:12+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce-title.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1344\" \/>\n\t<meta property=\"og:image:height\" content=\"768\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Christopher Ort\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:site\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Christopher Ort\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce\"},\"author\":{\"name\":\"Christopher Ort\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\"},\"headline\":\"CVE-2026-123022: AgentScope MCP Workspace Allows Unauthenticated Remote Code Execution\",\"datePublished\":\"2026-11-11T16:18:12+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce\"},\"wordCount\":747,\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce-title.webp\",\"articleSection\":[\"Agents\",\"AI Security\",\"Policy &amp; Safety\",\"Security &amp; Defense\"],\"inLanguage\":\"en-US\",\"dateModified\":\"2026-11-11T16:18:12+00:00\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce\",\"name\":\"CVE-2026-123022 AgentScope RCE Vulnerability\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce-title.webp\",\"datePublished\":\"2026-11-11T16:18:12+00:00\",\"description\":\"CVE-2026-123022 allows unauthenticated attackers to execute arbitrary code on AgentScope servers via MCP workspace API command injection with CVSS 7.3.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce#primaryimage\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce-title.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce-title.webp\",\"width\":1344,\"height\":768,\"caption\":\"A security operations center analyst reviewing critical vulnerability alerts on multiple monitors in a dimly lit room\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/i10x.ai\\\/news\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CVE-2026-123022: AgentScope MCP Workspace Allows Unauthenticated Remote Code Execution\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\",\"name\":\"i10X News\",\"description\":\"Stay updated with the latest news and announcements from i10X.\",\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/i10x.ai\\\/news?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\",\"name\":\"i10X\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"contentUrl\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"width\":180,\"height\":180,\"caption\":\"i10X\"},\"image\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/i10x_ai\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/i10x-ai\",\"https:\\\/\\\/instagram.com\\\/i10x.ai\",\"https:\\\/\\\/www.youtube.com\\\/@i10X_ai_official\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\",\"name\":\"Christopher Ort\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"caption\":\"Christopher Ort\"},\"description\":\"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/author\\\/christopher-ort\",\"sameAs\":[\"https:\\\/\\\/i10x.ai\\\/blog\\\/author\\\/christopher-ort\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"alumniOf\":{\"@type\":\"EducationalOrganization\",\"name\":\"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)\",\"url\":\"https:\\\/\\\/www.fau.eu\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CVE-2026-123022 AgentScope RCE Vulnerability","description":"CVE-2026-123022 allows unauthenticated attackers to execute arbitrary code on AgentScope servers via MCP workspace API command injection with CVSS 7.3.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce","og_locale":"en_US","og_type":"article","og_title":"CVE-2026-123022 AgentScope RCE Vulnerability","og_description":"CVE-2026-123022 allows unauthenticated attackers to execute arbitrary code on AgentScope servers via MCP workspace API command injection with CVSS 7.3.","og_url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce","og_site_name":"i10X News","article_published_time":"2026-11-11T16:18:12+00:00","og_image":[{"width":1344,"height":768,"url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce-title.webp","type":"image\/webp"}],"author":"Christopher Ort","twitter_card":"summary_large_image","twitter_creator":"@i10x_ai","twitter_site":"@i10x_ai","twitter_misc":{"Written by":"Christopher Ort","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce#article","isPartOf":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce"},"author":{"name":"Christopher Ort","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a"},"headline":"CVE-2026-123022: AgentScope MCP Workspace Allows Unauthenticated Remote Code Execution","datePublished":"2026-11-11T16:18:12+00:00","mainEntityOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce"},"wordCount":747,"publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce-title.webp","articleSection":["Agents","AI Security","Policy &amp; Safety","Security &amp; Defense"],"inLanguage":"en-US","dateModified":"2026-11-11T16:18:12+00:00"},{"@type":"WebPage","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce","url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce","name":"CVE-2026-123022 AgentScope RCE Vulnerability","isPartOf":{"@id":"https:\/\/i10x.ai\/news\/#website"},"primaryImageOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce#primaryimage"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce-title.webp","datePublished":"2026-11-11T16:18:12+00:00","description":"CVE-2026-123022 allows unauthenticated attackers to execute arbitrary code on AgentScope servers via MCP workspace API command injection with CVSS 7.3.","breadcrumb":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/i10xnews.kinsta.cloud\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce#primaryimage","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce-title.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce-title.webp","width":1344,"height":768,"caption":"A security operations center analyst reviewing critical vulnerability alerts on multiple monitors in a dimly lit room"},{"@type":"BreadcrumbList","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123022-agentscope-mcp-workspace-unauthenticated-rce#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/i10x.ai\/news"},{"@type":"ListItem","position":2,"name":"CVE-2026-123022: AgentScope MCP Workspace Allows Unauthenticated Remote Code Execution"}]},{"@type":"WebSite","@id":"https:\/\/i10x.ai\/news\/#website","url":"https:\/\/i10x.ai\/news","name":"i10X News","description":"Stay updated with the latest news and announcements from i10X.","publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/i10x.ai\/news?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/i10x.ai\/news\/#organization","name":"i10X","url":"https:\/\/i10x.ai\/news\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/","url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","contentUrl":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","width":180,"height":180,"caption":"i10X"},"image":{"@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/i10x_ai","https:\/\/www.linkedin.com\/company\/i10x-ai","https:\/\/instagram.com\/i10x.ai","https:\/\/www.youtube.com\/@i10X_ai_official"]},{"@type":"Person","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a","name":"Christopher Ort","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","caption":"Christopher Ort"},"description":"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.","url":"https:\/\/i10x.ai\/news\/author\/christopher-ort","sameAs":["https:\/\/i10x.ai\/blog\/author\/christopher-ort"],"worksFor":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"alumniOf":{"@type":"EducationalOrganization","name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)","url":"https:\/\/www.fau.eu"}}]}},"_links":{"self":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/7210","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/comments?post=7210"}],"version-history":[{"count":0,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/7210\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media\/7209"}],"wp:attachment":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media?parent=7210"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/categories?post=7210"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/tags?post=7210"},{"taxonomy":"company","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/companies?post=7210"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/products?post=7210"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}